Mageia alert MGASA-2018-0198 (libvncserver)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2018-0198: Updated libvncserver packages fix security vulnerability 
Date:
    	     
 
Sun, 8 Apr 2018 23:38:30 +0200
Message-ID:
    	     
 
<20180408213830.513149FEF5@duvel.mageia.org>
MGASA-2018-0198 - Updated libvncserver packages fix security vulnerability

Publication date: 08 Apr 2018
URL: https://advisories.mageia.org/MGASA-2018-0198.html
Type: security
Affected Mageia releases: 5, 6
CVE: CVE-2018-7225

Description:
An issue was discovered in LibVNCServer through 0.9.11.
rfbProcessClientNormalMessage() in rfbserver.c does not sanitize
msg.cct.length, leading to access to uninitialized and potentially
sensitive data or possibly unspecified other impact (e.g., an integer
overflow) via specially crafted VNC packets (CVE-2018-7225).

References:
- https://bugs.mageia.org/show_bug.cgi?id=22847
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7225

SRPMS:
- 6/core/libvncserver-0.9.11-1.1.mga6
- 5/core/libvncserver-0.9.10-1.3.mga5