Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-9941 (GCVE-0-2016-9941)
Vulnerability from cvelistv5
- n/a
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T03:07:31.407Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "95170", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/95170" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "name": "DSA-3753", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2017/dsa-3753" }, { "name": "GLSA-201702-24", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201702-24" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "name": "USN-4587-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4587-1/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-12-31T00:00:00", "descriptions": [ { "lang": "en", "value": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-10-23T12:06:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "95170", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/95170" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "name": "DSA-3753", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2017/dsa-3753" }, { "name": "GLSA-201702-24", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201702-24" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "name": "USN-4587-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4587-1/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-9941", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "95170", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95170" }, { "name": "https://github.com/LibVNC/libvncserver/pull/137", "refsource": "CONFIRM", "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "name": "DSA-3753", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3753" }, { "name": "GLSA-201702-24", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201702-24" }, { "name": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11", "refsource": "CONFIRM", "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "name": "USN-4587-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4587-1/" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-9941", "datePublished": "2016-12-31T18:00:00", "dateReserved": "2016-12-13T00:00:00", "dateUpdated": "2024-08-06T03:07:31.407Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2016-9941\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-12-31T18:59:00.133\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en rfbproto.c en LibVNCClient en LibVNCServer en versiones anteriores a 0.9.11 permite a servidores remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de aplicaci\u00f3n) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de un mensaje FramebufferUpdate manipulado que contiene un subrect\u00e1ngulo fuera del \u00e1rea de dibujo del cliente.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.9.10\",\"matchCriteriaId\":\"F09960B4-2704-4B36-B056-476F4DD30C9B\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2017/dsa-3753\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/95170\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/LibVNC/libvncserver/pull/137\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/201702-24\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/4587-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2017/dsa-3753\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/95170\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/LibVNC/libvncserver/pull/137\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201702-24\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4587-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}" } }
suse-su-2017:0519-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for tigervnc", "title": "Title of the patch" }, { "category": "description", "text": "\nThis update for tigervnc provides the following fixes:\n\n- Prevent malicious server from crashing a server via a buffer overflow, a similar flaw as the LibVNCServer issues CVE-2016-9941 and CVE-2016-9942.. (bsc#1019274)\n- CVE-2016-10207: Prevent potential crash due to insufficient clean-up after failure to establish TLS\n connection. (bsc#1023012)\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-DESKTOP-12-SP1-2017-263,SUSE-SLE-SERVER-12-SP1-2017-263", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0519-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2017:0519-1", "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170519-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2017:0519-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-February/002656.html" }, { "category": "self", "summary": "SUSE Bug 1019274", "url": "https://bugzilla.suse.com/1019274" }, { "category": "self", "summary": "SUSE Bug 1023012", "url": "https://bugzilla.suse.com/1023012" }, { "category": "self", "summary": "SUSE CVE CVE-2016-10207 page", "url": "https://www.suse.com/security/cve/CVE-2016-10207/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9941 page", "url": "https://www.suse.com/security/cve/CVE-2016-9941/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9942 page", "url": "https://www.suse.com/security/cve/CVE-2016-9942/" } ], "title": "Security update for tigervnc", "tracking": { "current_release_date": "2017-02-20T10:05:40Z", "generator": { "date": "2017-02-20T10:05:40Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2017:0519-1", "initial_release_date": "2017-02-20T10:05:40Z", "revision_history": [ { "date": "2017-02-20T10:05:40Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "tigervnc-1.4.3-19.1.ppc64le", "product": { "name": "tigervnc-1.4.3-19.1.ppc64le", "product_id": "tigervnc-1.4.3-19.1.ppc64le" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "product": { "name": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "product_id": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "tigervnc-1.4.3-19.1.s390x", "product": { "name": "tigervnc-1.4.3-19.1.s390x", "product_id": "tigervnc-1.4.3-19.1.s390x" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.4.3-19.1.s390x", "product": { "name": "xorg-x11-Xvnc-1.4.3-19.1.s390x", "product_id": "xorg-x11-Xvnc-1.4.3-19.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "tigervnc-1.4.3-19.1.x86_64", "product": { "name": "tigervnc-1.4.3-19.1.x86_64", "product_id": "tigervnc-1.4.3-19.1.x86_64" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.4.3-19.1.x86_64", "product": { "name": "xorg-x11-Xvnc-1.4.3-19.1.x86_64", "product_id": "xorg-x11-Xvnc-1.4.3-19.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP1", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP1", "product": { "name": "SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64" }, "product_reference": "tigervnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le" }, "product_reference": "tigervnc-1.4.3-19.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.s390x as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x" }, "product_reference": "tigervnc-1.4.3-19.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64" }, "product_reference": "tigervnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.s390x as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le" }, "product_reference": "tigervnc-1.4.3-19.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x" }, "product_reference": "tigervnc-1.4.3-19.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64" }, "product_reference": "tigervnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.4.3-19.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.4.3-19.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10207", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-10207" } ], "notes": [ { "category": "general", "text": "The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-10207", "url": "https://www.suse.com/security/cve/CVE-2016-10207" }, { "category": "external", "summary": "SUSE Bug 1023012 for CVE-2016-10207", "url": "https://bugzilla.suse.com/1023012" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-02-20T10:05:40Z", "details": "important" } ], "title": "CVE-2016-10207" }, { "cve": "CVE-2016-9941", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9941" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9941", "url": "https://www.suse.com/security/cve/CVE-2016-9941" }, { "category": "external", "summary": "SUSE Bug 1017711 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1017711" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-02-20T10:05:40Z", "details": "moderate" } ], "title": "CVE-2016-9941" }, { "cve": "CVE-2016-9942", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9942" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9942", "url": "https://www.suse.com/security/cve/CVE-2016-9942" }, { "category": "external", "summary": "SUSE Bug 1017712 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1017712" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tigervnc-1.4.3-19.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:xorg-x11-Xvnc-1.4.3-19.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-02-20T10:05:40Z", "details": "moderate" } ], "title": "CVE-2016-9942" } ] }
suse-su-2017:0622-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for tigervnc", "title": "Title of the patch" }, { "category": "description", "text": "\nThis update for tigervnc provides the following fixes:\n\n- Prevent malicious server from crashing a server via a buffer overflow, a similar flaw as the LibVNCServer issues CVE-2016-9941 and CVE-2016-9942. (bsc#1019274)\n- CVE-2016-10207: Prevent potential crash due to insufficient clean-up after failure to establish TLS\n connection. (bsc#1023012)\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-DESKTOP-12-SP2-2017-335,SUSE-SLE-RPI-12-SP2-2017-335,SUSE-SLE-SERVER-12-SP2-2017-335", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0622-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2017:0622-1", "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170622-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2017:0622-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-March/002682.html" }, { "category": "self", "summary": "SUSE Bug 1019274", "url": "https://bugzilla.suse.com/1019274" }, { "category": "self", "summary": "SUSE Bug 1023012", "url": "https://bugzilla.suse.com/1023012" }, { "category": "self", "summary": "SUSE CVE CVE-2016-10207 page", "url": "https://www.suse.com/security/cve/CVE-2016-10207/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9941 page", "url": "https://www.suse.com/security/cve/CVE-2016-9941/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9942 page", "url": "https://www.suse.com/security/cve/CVE-2016-9942/" } ], "title": "Security update for tigervnc", "tracking": { "current_release_date": "2017-03-07T12:58:53Z", "generator": { "date": "2017-03-07T12:58:53Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2017:0622-1", "initial_release_date": "2017-03-07T12:58:53Z", "revision_history": [ { "date": "2017-03-07T12:58:53Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libXvnc1-1.6.0-16.4.aarch64", "product": { "name": "libXvnc1-1.6.0-16.4.aarch64", "product_id": "libXvnc1-1.6.0-16.4.aarch64" } }, { "category": "product_version", "name": "tigervnc-1.6.0-16.4.aarch64", "product": { "name": "tigervnc-1.6.0-16.4.aarch64", "product_id": "tigervnc-1.6.0-16.4.aarch64" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.6.0-16.4.aarch64", "product": { "name": "xorg-x11-Xvnc-1.6.0-16.4.aarch64", "product_id": "xorg-x11-Xvnc-1.6.0-16.4.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libXvnc1-1.6.0-16.4.ppc64le", "product": { "name": "libXvnc1-1.6.0-16.4.ppc64le", "product_id": "libXvnc1-1.6.0-16.4.ppc64le" } }, { "category": "product_version", "name": "tigervnc-1.6.0-16.4.ppc64le", "product": { "name": "tigervnc-1.6.0-16.4.ppc64le", "product_id": "tigervnc-1.6.0-16.4.ppc64le" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "product": { "name": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "product_id": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libXvnc1-1.6.0-16.4.s390x", "product": { "name": "libXvnc1-1.6.0-16.4.s390x", "product_id": "libXvnc1-1.6.0-16.4.s390x" } }, { "category": "product_version", "name": "tigervnc-1.6.0-16.4.s390x", "product": { "name": "tigervnc-1.6.0-16.4.s390x", "product_id": "tigervnc-1.6.0-16.4.s390x" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.6.0-16.4.s390x", "product": { "name": "xorg-x11-Xvnc-1.6.0-16.4.s390x", "product_id": "xorg-x11-Xvnc-1.6.0-16.4.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libXvnc1-1.6.0-16.4.x86_64", "product": { "name": "libXvnc1-1.6.0-16.4.x86_64", "product_id": "libXvnc1-1.6.0-16.4.x86_64" } }, { "category": "product_version", "name": "tigervnc-1.6.0-16.4.x86_64", "product": { "name": "tigervnc-1.6.0-16.4.x86_64", "product_id": "tigervnc-1.6.0-16.4.x86_64" } }, { "category": "product_version", "name": "xorg-x11-Xvnc-1.6.0-16.4.x86_64", "product": { "name": "xorg-x11-Xvnc-1.6.0-16.4.x86_64", "product_id": "xorg-x11-Xvnc-1.6.0-16.4.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP2", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP2", "product_id": "SUSE Linux Enterprise Desktop 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2", "product": { "name": "SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp2" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2", "product_id": "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64" }, "product_reference": "libXvnc1-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2", "product_id": "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64" }, "product_reference": "tigervnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2", "product_id": "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64" }, "product_reference": "libXvnc1-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64" }, "product_reference": "tigervnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64" }, "product_reference": "libXvnc1-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le" }, "product_reference": "libXvnc1-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x" }, "product_reference": "libXvnc1-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64" }, "product_reference": "libXvnc1-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64" }, "product_reference": "tigervnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le" }, "product_reference": "tigervnc-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x" }, "product_reference": "tigervnc-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64" }, "product_reference": "tigervnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64" }, "product_reference": "libXvnc1-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le" }, "product_reference": "libXvnc1-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x" }, "product_reference": "libXvnc1-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libXvnc1-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64" }, "product_reference": "libXvnc1-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64" }, "product_reference": "tigervnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le" }, "product_reference": "tigervnc-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x" }, "product_reference": "tigervnc-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "tigervnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64" }, "product_reference": "tigervnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "xorg-x11-Xvnc-1.6.0-16.4.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" }, "product_reference": "xorg-x11-Xvnc-1.6.0-16.4.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10207", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-10207" } ], "notes": [ { "category": "general", "text": "The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-10207", "url": "https://www.suse.com/security/cve/CVE-2016-10207" }, { "category": "external", "summary": "SUSE Bug 1023012 for CVE-2016-10207", "url": "https://bugzilla.suse.com/1023012" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-03-07T12:58:53Z", "details": "important" } ], "title": "CVE-2016-10207" }, { "cve": "CVE-2016-9941", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9941" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9941", "url": "https://www.suse.com/security/cve/CVE-2016-9941" }, { "category": "external", "summary": "SUSE Bug 1017711 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1017711" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-03-07T12:58:53Z", "details": "moderate" } ], "title": "CVE-2016-9941" }, { "cve": "CVE-2016-9942", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9942" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9942", "url": "https://www.suse.com/security/cve/CVE-2016-9942" }, { "category": "external", "summary": "SUSE Bug 1017712 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1017712" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libXvnc1-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:tigervnc-1.6.0-16.4.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-Xvnc-1.6.0-16.4.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-03-07T12:58:53Z", "details": "moderate" } ], "title": "CVE-2016-9942" } ] }
suse-su-2017:0104-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "\nLibVNCServer was updated to fix two security issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9941: Heap-based buffer overflow in rfbproto.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area (bsc#1017711)\n- CVE-2016-9942: Heap-based buffer overflow in ultra.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions (bsc#1017712)\n", "title": "Description of the patch" }, { "category": "details", "text": "sdksp4-LibVNCServer-12932,slessp4-LibVNCServer-12932", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0104-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2017:0104-1", "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170104-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2017:0104-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2017-January/002550.html" }, { "category": "self", "summary": "SUSE Bug 1017711", "url": "https://bugzilla.suse.com/1017711" }, { "category": "self", "summary": "SUSE Bug 1017712", "url": "https://bugzilla.suse.com/1017712" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9941 page", "url": "https://www.suse.com/security/cve/CVE-2016-9941/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9942 page", "url": "https://www.suse.com/security/cve/CVE-2016-9942/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2017-01-11T09:26:50Z", "generator": { "date": "2017-01-11T09:26:50Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2017:0104-1", "initial_release_date": "2017-01-11T09:26:50Z", "revision_history": [ { "date": "2017-01-11T09:26:50Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.1-159.1.i586", "product": { "name": "LibVNCServer-devel-0.9.1-159.1.i586", "product_id": "LibVNCServer-devel-0.9.1-159.1.i586" } }, { "category": "product_version", "name": "LibVNCServer-0.9.1-159.1.i586", "product": { "name": "LibVNCServer-0.9.1-159.1.i586", "product_id": "LibVNCServer-0.9.1-159.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.1-159.1.ia64", "product": { "name": "LibVNCServer-devel-0.9.1-159.1.ia64", "product_id": "LibVNCServer-devel-0.9.1-159.1.ia64" } }, { "category": "product_version", "name": "LibVNCServer-0.9.1-159.1.ia64", "product": { "name": "LibVNCServer-0.9.1-159.1.ia64", "product_id": "LibVNCServer-0.9.1-159.1.ia64" } } ], "category": "architecture", "name": "ia64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.1-159.1.ppc64", "product": { "name": "LibVNCServer-devel-0.9.1-159.1.ppc64", "product_id": "LibVNCServer-devel-0.9.1-159.1.ppc64" } }, { "category": "product_version", "name": "LibVNCServer-0.9.1-159.1.ppc64", "product": { "name": "LibVNCServer-0.9.1-159.1.ppc64", "product_id": "LibVNCServer-0.9.1-159.1.ppc64" } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.1-159.1.s390x", "product": { "name": "LibVNCServer-devel-0.9.1-159.1.s390x", "product_id": "LibVNCServer-devel-0.9.1-159.1.s390x" } }, { "category": "product_version", "name": "LibVNCServer-0.9.1-159.1.s390x", "product": { "name": "LibVNCServer-0.9.1-159.1.s390x", "product_id": "LibVNCServer-0.9.1-159.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.1-159.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.1-159.1.x86_64", "product_id": "LibVNCServer-devel-0.9.1-159.1.x86_64" } }, { "category": "product_version", "name": "LibVNCServer-0.9.1-159.1.x86_64", "product": { "name": "LibVNCServer-0.9.1-159.1.x86_64", "product_id": "LibVNCServer-0.9.1-159.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product": { "name": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4", "product_identification_helper": { "cpe": "cpe:/a:suse:sle-sdk:11:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 11 SP4", "product": { "name": "SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_sles:11:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:11:sp4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.1-159.1.i586 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586" }, "product_reference": "LibVNCServer-devel-0.9.1-159.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.1-159.1.ia64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64" }, "product_reference": "LibVNCServer-devel-0.9.1-159.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.1-159.1.ppc64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64" }, "product_reference": "LibVNCServer-devel-0.9.1-159.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.1-159.1.s390x as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x" }, "product_reference": "LibVNCServer-devel-0.9.1-159.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.1-159.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 11 SP4", "product_id": "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.1-159.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.i586 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586" }, "product_reference": "LibVNCServer-0.9.1-159.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64" }, "product_reference": "LibVNCServer-0.9.1-159.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64" }, "product_reference": "LibVNCServer-0.9.1-159.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.s390x as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x" }, "product_reference": "LibVNCServer-0.9.1-159.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", "product_id": "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64" }, "product_reference": "LibVNCServer-0.9.1-159.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586" }, "product_reference": "LibVNCServer-0.9.1-159.1.i586", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64" }, "product_reference": "LibVNCServer-0.9.1-159.1.ia64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64" }, "product_reference": "LibVNCServer-0.9.1-159.1.ppc64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x" }, "product_reference": "LibVNCServer-0.9.1-159.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-0.9.1-159.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64" }, "product_reference": "LibVNCServer-0.9.1-159.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-9941", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9941" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9941", "url": "https://www.suse.com/security/cve/CVE-2016-9941" }, { "category": "external", "summary": "SUSE Bug 1017711 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1017711" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-01-11T09:26:50Z", "details": "moderate" } ], "title": "CVE-2016-9941" }, { "cve": "CVE-2016-9942", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9942" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9942", "url": "https://www.suse.com/security/cve/CVE-2016-9942" }, { "category": "external", "summary": "SUSE Bug 1017712 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1017712" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:LibVNCServer-0.9.1-159.1.x86_64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.i586", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ia64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.ppc64", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.s390x", "SUSE Linux Enterprise Software Development Kit 11 SP4:LibVNCServer-devel-0.9.1-159.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-01-11T09:26:50Z", "details": "moderate" } ], "title": "CVE-2016-9942" } ] }
suse-su-2018:0830-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "\nLibVNCServer was updated to fix two security issues.\n\nThese security issues were fixed:\n\n- CVE-2018-7225: Missing input sanitization inside rfbserver.c rfbProcessClientNormalMessage() (bsc#1081493).\n- CVE-2016-9942: Heap-based buffer overflow in ultra.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions (bsc#1017712).\n- CVE-2016-9941: Heap-based buffer overflow in rfbproto.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area (bsc#1017711).\n ", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-RPI-12-SP2-2018-554,SUSE-SLE-SDK-12-SP2-2018-554,SUSE-SLE-SDK-12-SP3-2018-554,SUSE-SLE-SERVER-12-SP2-2018-554,SUSE-SLE-SERVER-12-SP3-2018-554", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_0830-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2018:0830-1", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20180830-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2018:0830-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-March/003847.html" }, { "category": "self", "summary": "SUSE Bug 1017711", "url": "https://bugzilla.suse.com/1017711" }, { "category": "self", "summary": "SUSE Bug 1017712", "url": "https://bugzilla.suse.com/1017712" }, { "category": "self", "summary": "SUSE Bug 1081493", "url": "https://bugzilla.suse.com/1081493" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9941 page", "url": "https://www.suse.com/security/cve/CVE-2016-9941/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9942 page", "url": "https://www.suse.com/security/cve/CVE-2016-9942/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-7225 page", "url": "https://www.suse.com/security/cve/CVE-2018-7225/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2018-03-27T14:28:22Z", "generator": { "date": "2018-03-27T14:28:22Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2018:0830-1", "initial_release_date": "2018-03-27T14:28:22Z", "revision_history": [ { "date": "2018-03-27T14:28:22Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libvncclient0-0.9.9-17.5.1.aarch64", "product": { "name": "libvncclient0-0.9.9-17.5.1.aarch64", "product_id": "libvncclient0-0.9.9-17.5.1.aarch64" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.5.1.aarch64", "product": { "name": "libvncserver0-0.9.9-17.5.1.aarch64", "product_id": "libvncserver0-0.9.9-17.5.1.aarch64" } }, { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.5.1.aarch64", "product": { "name": "LibVNCServer-devel-0.9.9-17.5.1.aarch64", "product_id": "LibVNCServer-devel-0.9.9-17.5.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "product": { "name": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "product_id": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.5.1.ppc64le", "product": { "name": "libvncclient0-0.9.9-17.5.1.ppc64le", "product_id": "libvncclient0-0.9.9-17.5.1.ppc64le" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.5.1.ppc64le", "product": { "name": "libvncserver0-0.9.9-17.5.1.ppc64le", "product_id": "libvncserver0-0.9.9-17.5.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.5.1.s390x", "product": { "name": "LibVNCServer-devel-0.9.9-17.5.1.s390x", "product_id": "LibVNCServer-devel-0.9.9-17.5.1.s390x" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.5.1.s390x", "product": { "name": "libvncclient0-0.9.9-17.5.1.s390x", "product_id": "libvncclient0-0.9.9-17.5.1.s390x" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.5.1.s390x", "product": { "name": "libvncserver0-0.9.9-17.5.1.s390x", "product_id": "libvncserver0-0.9.9-17.5.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.5.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.9-17.5.1.x86_64", "product_id": "LibVNCServer-devel-0.9.9-17.5.1.x86_64" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.5.1.x86_64", "product": { "name": "libvncclient0-0.9.9-17.5.1.x86_64", "product_id": "libvncclient0-0.9.9-17.5.1.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.5.1.x86_64", "product": { "name": "libvncserver0-0.9.9-17.5.1.x86_64", "product_id": "libvncserver0-0.9.9-17.5.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 12 SP2", "product": { "name": "SUSE Linux Enterprise Software Development Kit 12 SP2", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-sdk:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 12 SP3", "product": { "name": "SUSE Linux Enterprise Software Development Kit 12 SP3", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-sdk:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2", "product": { "name": "SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP3", "product": { "name": "SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp3" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2", "product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP2", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP2", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP2", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP3", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP3", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP3", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP3", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2", "product_id": "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3", "product_id": "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.5.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.5.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.5.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-9941", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9941" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9941", "url": "https://www.suse.com/security/cve/CVE-2016-9941" }, { "category": "external", "summary": "SUSE Bug 1017711 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1017711" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9941", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-03-27T14:28:22Z", "details": "moderate" } ], "title": "CVE-2016-9941" }, { "cve": "CVE-2016-9942", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-9942" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-9942", "url": "https://www.suse.com/security/cve/CVE-2016-9942" }, { "category": "external", "summary": "SUSE Bug 1017712 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1017712" }, { "category": "external", "summary": "SUSE Bug 1019274 for CVE-2016-9942", "url": "https://bugzilla.suse.com/1019274" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-03-27T14:28:22Z", "details": "moderate" } ], "title": "CVE-2016-9942" }, { "cve": "CVE-2018-7225", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-7225" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-7225", "url": "https://www.suse.com/security/cve/CVE-2018-7225" }, { "category": "external", "summary": "SUSE Bug 1081493 for CVE-2018-7225", "url": "https://bugzilla.suse.com/1081493" }, { "category": "external", "summary": "SUSE Bug 1090647 for CVE-2018-7225", "url": "https://bugzilla.suse.com/1090647" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP2:LibVNCServer-devel-0.9.9-17.5.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP3:LibVNCServer-devel-0.9.9-17.5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2018-03-27T14:28:22Z", "details": "important" } ], "title": "CVE-2018-7225" } ] }
ghsa-96f2-683j-mrm6
Vulnerability from github
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.
{ "affected": [], "aliases": [ "CVE-2016-9941" ], "database_specific": { "cwe_ids": [ "CWE-119" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2016-12-31T18:59:00Z", "severity": "CRITICAL" }, "details": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "id": "GHSA-96f2-683j-mrm6", "modified": "2025-04-12T13:07:54Z", "published": "2022-05-13T01:14:08Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9941" }, { "type": "WEB", "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "type": "WEB", "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201702-24" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4587-1" }, { "type": "WEB", "url": "http://www.debian.org/security/2017/dsa-3753" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/95170" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
gsd-2016-9941
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2016-9941", "description": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "id": "GSD-2016-9941", "references": [ "https://www.suse.com/security/cve/CVE-2016-9941.html", "https://www.debian.org/security/2017/dsa-3753", "https://ubuntu.com/security/CVE-2016-9941", "https://advisories.mageia.org/CVE-2016-9941.html", "https://security.archlinux.org/CVE-2016-9941" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2016-9941" ], "details": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.", "id": "GSD-2016-9941", "modified": "2023-12-13T01:21:21.910422Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-9941", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "95170", "refsource": "BID", "url": "http://www.securityfocus.com/bid/95170" }, { "name": "https://github.com/LibVNC/libvncserver/pull/137", "refsource": "CONFIRM", "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "name": "DSA-3753", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3753" }, { "name": "GLSA-201702-24", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201702-24" }, { "name": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11", "refsource": "CONFIRM", "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "name": "USN-4587-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4587-1/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "0.9.10", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-9941" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-119" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11", "refsource": "CONFIRM", "tags": [], "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "name": "https://github.com/LibVNC/libvncserver/pull/137", "refsource": "CONFIRM", "tags": [], "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "name": "95170", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/95170" }, { "name": "DSA-3753", "refsource": "DEBIAN", "tags": [], "url": "http://www.debian.org/security/2017/dsa-3753" }, { "name": "GLSA-201702-24", "refsource": "GENTOO", "tags": [], "url": "https://security.gentoo.org/glsa/201702-24" }, { "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update", "refsource": "MLIST", "tags": [], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "name": "USN-4587-1", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4587-1/" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "lastModifiedDate": "2020-10-23T13:15Z", "publishedDate": "2016-12-31T18:59Z" } } }
cnvd-2017-00064
Vulnerability from cnvd
Title: LibVNCServer堆缓冲区溢出漏洞
Description:
LibVNCServer是跨平台的C库。
LibVNCServer 0.9.11之前版本中存在堆缓冲区溢出漏洞,攻击者可以利用漏洞在应用程序的上下文中执行任意代码。利用失败可能导致拒绝服务条件。
Severity: 高
Patch Name: LibVNCServer堆缓冲区溢出漏洞的补丁
Patch Description:
LibVNCServer是跨平台的C库。
LibVNCServer 0.9.11之前版本中存在堆缓冲区溢出漏洞,攻击者可以利用漏洞在应用程序的上下文中执行任意代码。利用失败可能导致拒绝服务条件。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description:
目前厂商已经发布了升级补丁以修复此安全问题,详情请关注厂商主页: http://libvnc.github.io/
Reference: https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11 http://www.securityfocus.com/bid/95170
Name | LibVNCServer LibVNCServer <0.9.11 |
---|
{ "bids": { "bid": { "bidNumber": "95170" } }, "cves": { "cve": { "cveNumber": "CVE-2016-9941" } }, "description": "LibVNCServer\u662f\u8de8\u5e73\u53f0\u7684C\u5e93\u3002 \r\n\r\nLibVNCServer 0.9.11\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u5229\u7528\u5931\u8d25\u53ef\u80fd\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6761\u4ef6\u3002", "discovererName": "Atalas", "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://libvnc.github.io/", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2017-00064", "openTime": "2017-01-04", "patchDescription": "LibVNCServer\u662f\u8de8\u5e73\u53f0\u7684C\u5e93\u3002 \r\n\r\nLibVNCServer 0.9.11\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u5229\u7528\u5931\u8d25\u53ef\u80fd\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u6761\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "LibVNCServer\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": "LibVNCServer LibVNCServer \u003c0.9.11" }, "referenceLink": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11\r\nhttp://www.securityfocus.com/bid/95170", "serverity": "\u9ad8", "submitTime": "2017-01-03", "title": "LibVNCServer\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e" }
fkie_cve-2016-9941
Vulnerability from fkie_nvd
Vendor | Product | Version | |
---|---|---|---|
libvncserver_project | libvncserver | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "F09960B4-2704-4B36-B056-476F4DD30C9B", "versionEndIncluding": "0.9.10", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area." }, { "lang": "es", "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en rfbproto.c en LibVNCClient en LibVNCServer en versiones anteriores a 0.9.11 permite a servidores remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de aplicaci\u00f3n) o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de un mensaje FramebufferUpdate manipulado que contiene un subrect\u00e1ngulo fuera del \u00e1rea de dibujo del cliente." } ], "id": "CVE-2016-9941", "lastModified": "2025-04-12T10:46:40.837", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2016-12-31T18:59:00.133", "references": [ { "source": "cve@mitre.org", "url": "http://www.debian.org/security/2017/dsa-3753" }, { "source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/95170" }, { "source": "cve@mitre.org", "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "source": "cve@mitre.org", "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201702-24" }, { "source": "cve@mitre.org", "url": "https://usn.ubuntu.com/4587-1/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3753" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/95170" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/LibVNC/libvncserver/pull/137" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201702-24" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4587-1/" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-119" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.