Ubuntu alert USN-8463-1 (libvncserver)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8463-1] LibVNCServer vulnerabilities | |
| Date: | Tue, 23 Jun 2026 16:14:42 +0000 | |
| Message-ID: | <E1wc3lq-00057X-8b@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8463-1 June 23, 2026 libvncserver vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in LibVNCServer. Software Description: - libvncserver: vnc server library Details: It was discovered that LibVNCServer had a memory leak in the client cleanup function. An attacker could possibly use this issue to cause LibVNCServer to consume memory, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2020-29260) It was discovered that LibVNCServer did not properly validate bounds when handling UltraZip encoding subrectangles. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2026-32853) It was discovered that LibVNCServer did not properly validate return values in the HTTP proxy handlers. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2026-32854) It was discovered that LibVNCServer did not properly handle Tight encoding gradient filter rectangles. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-44988) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libvncclient1 0.9.15+dfsg-3ubuntu0.1 libvncserver1 0.9.15+dfsg-3ubuntu0.1 Ubuntu 25.10 libvncclient1 0.9.15+dfsg-1ubuntu0.1 libvncserver1 0.9.15+dfsg-1ubuntu0.1 Ubuntu 24.04 LTS libvncclient1 0.9.14+dfsg-1ubuntu0.1 libvncserver1 0.9.14+dfsg-1ubuntu0.1 Ubuntu 22.04 LTS libvncclient1 0.9.13+dfsg-3ubuntu0.1 libvncserver1 0.9.13+dfsg-3ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8463-1 CVE-2020-29260, CVE-2026-32853, CVE-2026-32854, CVE-2026-44988 Package Information: https://launchpad.net/ubuntu/+source/libvncserver/0.9.15+... https://launchpad.net/ubuntu/+source/libvncserver/0.9.15+... https://launchpad.net/ubuntu/+source/libvncserver/0.9.14+... https://launchpad.net/ubuntu/+source/libvncserver/0.9.13+...
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmo6pckACgkQcpJm3tlz hgGgYA/+N2Ha1Rn9ArbM7N3jJnDl8hmDMp/JnauFt4HmCTuj50L4aqnkHeG41OpP 8hOmR5TwljODl417b9lodomlaD+yGs9VvtDBfAxLIAZUjN1u47ERS1ECGzOIuTn8 0ua2Koo4QE2hT1pFiXgIjK59ycg9okpfba3QGMpJCWxfp/ehca0L/T956xS7TrpQ ChgEwceBj8D6kJTVaMclJ22dQKR7jWVpdCmX2D9TMI9AQMKinQPVpPIxThuLrdjM wvdON7AlMZbEkSe9yxAiruAUuor3YplcIcDV7WhetM9DixqTjZJrHNtU1lSXtn4w 5FoYfjrXhcXzi2jpBdMnO88j+2WVEm/WNHNgEswL+GTbMp1PT98VERZ98tRI/1It O4CIK7chQDC8wr4K31wO4+KlIfKmDFjOov5bOgihawhb8qygAle0j8NIyn7Ts6E8 AQHNBITTb431gl5kzk43tIXb9l0ZoC88lgwu/ecQUVGdyxwJpRs+GelsV9GBZUNp G/CwS/fkScdQHJAfUu/i63d2wT3nEjqcNRpGMnJo8e6PNDaNWkFunmXs00P9waNx FuUD4T0e2jiSFemJ3VfPBF26M3/DKasrSXVaUgXHVlmgsessAp4xD7EkAQ88qnVz PUbYrLH38WaLqXDKu36icBbDSn5kLRX5AeUZBZKtLfbOlAOS8TA= =+HP0 -----END PGP SIGNATURE-----