SB2021052205 - Red Hat Enterprise Linux 8 update for libvncserver
Published: May 22, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2018-21247)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due memory leak within the ConnectToRFBRepeater() function in libvncclient/rfbproto.c. A remote attacker can trick the victim to connect to a malicious VNC server, trigger the memory leak and gain access to sensitive information on the client's system.
2) Buffer overflow (CVE-ID: CVE-2019-20839)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary when processing long socket filename in libvncclient/sockets.c in LibVNCServer. A remote attacker can rick the victim to connect to server using a specially crafted configuration file, trigger buffer overflow and execute arbitrary code on the target system.
3) NULL pointer dereference (CVE-ID: CVE-2020-14397)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in libvncserver/rfbregion.c. A remote attacker can perform a denial of service (DoS) attack.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2020-14405)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists in libvncclient/rfbproto.c due to LibVNCServer does not limit TextChat size.A remote attacker who controls a malicious VNC server can send large amounts of data to the client application and perform a denial of service (DoS) attack.
5) Division by zero (CVE-ID: CVE-2020-25708)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to divide by zero error when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service. A remote attacker can pass specially crafted file to the application and crash it.
Remediation
Install update from vendor's website.