Ubuntu alert USN-3618-1 (libvncserver)
| From: | Marc Deslauriers <marc.deslauriers@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-3618-1] LibVNCServer vulnerability | |
| Date: | Wed, 4 Apr 2018 11:51:21 -0400 | |
| Message-ID: | <523deba4-05b0-6373-e5eb-f89dc286bd08@canonical.com> |
========================================================================== Ubuntu Security Notice USN-3618-1 April 04, 2018 libvncserver vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: LibVNCServer could be made to crash, expose sensitive information, or run programs if it received specially crafted network traffic. Software Description: - libvncserver: vnc server library Details: It was discovered that LibVNCServer incorrectly handled certain packet lengths. A remote attacker able to connect to a LibVNCServer could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: libvncclient1 0.9.11+dfsg-1ubuntu0.1 libvncserver1 0.9.11+dfsg-1ubuntu0.1 Ubuntu 16.04 LTS: libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.2 Ubuntu 14.04 LTS: libvncserver0 0.9.9+dfsg-1ubuntu1.3 After a standard system update you need to restart LibVNCServer applications to make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3618-1 CVE-2018-7225 Package Information: https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+... https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+... https://launchpad.net/ubuntu/+source/libvncserver/0.9.9+d... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...