Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-20840 (GCVE-0-2019-20840)
Vulnerability from cvelistv5
- n/a
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T02:53:09.404Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "name": "FEDORA-2020-1a4b1c8271", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "name": "openSUSE-SU-2020:0988", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "name": "openSUSE-SU-2020:1025", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "name": "openSUSE-SU-2020:1056", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "name": "USN-4434-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4434-1/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-12-14T13:06:18", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "name": "FEDORA-2020-1a4b1c8271", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "name": "openSUSE-SU-2020:0988", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "name": "openSUSE-SU-2020:1025", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "name": "openSUSE-SU-2020:1056", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "name": "USN-4434-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4434-1/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-20840", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13", "refsource": "MISC", "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "name": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76", "refsource": "MISC", "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "name": "FEDORA-2020-1a4b1c8271", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "name": "openSUSE-SU-2020:0988", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "name": "openSUSE-SU-2020:1025", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "name": "openSUSE-SU-2020:1056", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "name": "USN-4434-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4434-1/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-20840", "datePublished": "2020-06-17T15:11:10", "dateReserved": "2020-06-17T00:00:00", "dateUpdated": "2024-08-05T02:53:09.404Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-20840\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-06-17T16:15:11.523\",\"lastModified\":\"2024-11-21T04:39:30.203\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.\"},{\"lang\":\"es\",\"value\":\"Se detect\u00f3 un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/ws_decode.c puede conllevar a un bloqueo debido a accesos no alineados en la funci\u00f3n hybiReadAndDecode\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.9.12\",\"matchCriteriaId\":\"A03A7282-D445-4E26-98A0-6A1597838D35\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"3A664216-EEA0-423F-8E11-59C746FDEEFE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9596C8CD-B03F-4E9D-82AB-0986FDD1B47C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"CD78291E-48D8-4718-AE14-BDF93BD557D7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BB898D3-07A3-42A1-8F1B-53C3B005982D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"AD1209DE-2724-493D-8276-1BE959BFE6BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A9143A6-A93A-45CA-8A1F-6EE30647B54A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"92F7FC17-F19F-4BD6-9704-49B67D22B532\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D34BD13-4E71-48A2-851D-AE7CE2A03C28\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"FE4A6F13-385B-4A13-B8D8-3BBC4E9D5B67\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E63E423-7450-4043-B33B-3FFF5BBE1CB2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"71A51CA4-1A62-47BC-99A3-4DC9F3986FF5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD278558-AB0E-4FC1-9E5B-6B57D29CB86A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/4434-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4434-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
var-202006-1849
Vulnerability from variot
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. LibVNCServer Exists in a buffer error vulnerability.Service operation interruption (DoS) It may be put into a state. ========================================================================== Ubuntu Security Notice USN-4434-1 July 23, 2020
libvncserver vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in LibVNCServer.
Software Description: - libvncserver: vnc server library
Details:
Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitrary code. (CVE-2019-20839)
It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)
Christian Beier discovered that LibVNCServer incorrectly handled anonymous TLS connections. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14396)
It was discovered that LibVNCServer incorrectly handled region clipping. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14397)
It was discovered that LibVNCServer did not properly reset incorrectly terminated TCP connections. A remote attacker could possibly use this issue to cause an infinite loop, resulting in a denial of service. (CVE-2020-14398)
It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399, CVE-2020-14400)
It was discovered that LibVNCServer incorrectly handled screen scaling on the server side. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14401)
It was discovered that LibVNCServer incorrectly handled encodings. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)
It was discovered that LibVNCServer incorrectly handled TextChat messages. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14405)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.2 libvncserver1 0.9.12+dfsg-9ubuntu0.2
Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.3 libvncserver1 0.9.11+dfsg-1ubuntu1.3
Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.5 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.5
After a standard system update you need to restart LibVNCServer applications to make all the necessary changes.
References: https://usn.ubuntu.com/4434-1 CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397, CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401, CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405
Package Information: https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2 https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3 https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202006-1849", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "simatic itc2200", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "simatic itc1500 pro", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "simatic itc2200 pro", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "simatic itc1900 pro", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "simatic itc2200", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "9.0" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "18.04" }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.2" }, { "model": "simatic itc1900", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "16.04" }, { "model": "simatic itc1500", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "14.04" }, { "model": "libvncserver", "scope": "lte", "trust": 1.0, "vendor": "libvnc", "version": "0.9.12" }, { "model": "simatic itc2200 pro", "scope": "gte", "trust": 1.0, "vendor": "siemens", "version": "3.0.0.0" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "20.04" }, { "model": "ubuntu linux", "scope": "eq", "trust": 1.0, "vendor": "canonical", "version": "18.10" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "8.0" }, { "model": "simatic itc1900 pro", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "simatic itc1500 pro", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "simatic itc1900", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "simatic itc1500", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "3.2.1.0" }, { "model": "libvncserver", "scope": "eq", "trust": 0.8, "vendor": "libvnc", "version": "0.9.13" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:libvncserver_project:libvncserver", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Ubuntu", "sources": [ { "db": "PACKETSTORM", "id": "158543" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" } ], "trust": 0.7 }, "cve": "CVE-2019-20840", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CVE-2019-20840", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 5.0, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "JVNDB-2019-015658", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CVE-2019-20840", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "JVNDB-2019-015658", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2019-20840", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "JVNDB-2019-015658", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-202006-1177", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. LibVNCServer Exists in a buffer error vulnerability.Service operation interruption (DoS) It may be put into a state. ==========================================================================\nUbuntu Security Notice USN-4434-1\nJuly 23, 2020\n\nlibvncserver vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in LibVNCServer. \n\nSoftware Description:\n- libvncserver: vnc server library\n\nDetails:\n\nRamin Farajpour Cami discovered that LibVNCServer incorrectly handled\ncertain malformed unix socket names. A remote attacker could exploit this\nwith a crafted socket name, leading to a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-20839)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)\n\nChristian Beier discovered that LibVNCServer incorrectly handled anonymous\nTLS connections. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2020-14396)\n\nIt was discovered that LibVNCServer incorrectly handled region clipping. A\nremote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14397)\n\nIt was discovered that LibVNCServer did not properly reset incorrectly\nterminated TCP connections. A remote attacker could possibly use this\nissue to cause an infinite loop, resulting in a denial of service. \n(CVE-2020-14398)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399,\nCVE-2020-14400)\n\nIt was discovered that LibVNCServer incorrectly handled screen scaling on\nthe server side. A remote attacker could use this issue to cause\nLibVNCServer to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2020-14401)\n\nIt was discovered that LibVNCServer incorrectly handled encodings. A\nremote attacker could use this issue to cause LibVNCServer to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)\n\nIt was discovered that LibVNCServer incorrectly handled TextChat messages. \nA remote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14405)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n libvncclient1 0.9.12+dfsg-9ubuntu0.2\n libvncserver1 0.9.12+dfsg-9ubuntu0.2\n\nUbuntu 18.04 LTS:\n libvncclient1 0.9.11+dfsg-1ubuntu1.3\n libvncserver1 0.9.11+dfsg-1ubuntu1.3\n\nUbuntu 16.04 LTS:\n libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.5\n libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.5\n\nAfter a standard system update you need to restart LibVNCServer\napplications to make all the necessary changes. \n\nReferences:\n https://usn.ubuntu.com/4434-1\n CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397,\n CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401,\n CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5\n", "sources": [ { "db": "NVD", "id": "CVE-2019-20840" }, { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "PACKETSTORM", "id": "158543" } ], "trust": 1.71 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-20840", "trust": 2.5 }, { "db": "SIEMENS", "id": "SSA-390195", "trust": 1.6 }, { "db": "JVNDB", "id": "JVNDB-2019-015658", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "158543", "trust": 0.7 }, { "db": "CS-HELP", "id": "SB2021121649", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.2469", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.2535", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.2727", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202006-1177", "trust": 0.6 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "PACKETSTORM", "id": "158543" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "id": "VAR-202006-1849", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.33603895 }, "last_update_date": "2024-11-23T19:27:13.094000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "fix crash because of unaligned accesses in hybiReadAndDecode()", "trust": 0.8, "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "title": "Comparing changes", "trust": 0.8, "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "title": "LibVNCServer Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=121869" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-787", "trust": 1.0 }, { "problemtype": "CWE-119", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.6, "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "trust": 1.6, "url": "https://github.com/libvnc/libvncserver/compare/libvncserver-0.9.12...libvncserver-0.9.13" }, { "trust": 1.6, "url": "https://github.com/libvnc/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "trust": 1.6, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "trust": 1.6, "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "trust": 1.6, "url": "https://usn.ubuntu.com/4434-1/" }, { "trust": 1.6, "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "trust": 1.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20840" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4f6fuh4efk4nap6gt4tqrtbkwirczliy/" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20840" }, { "trust": 0.6, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4f6fuh4efk4nap6gt4tqrtbkwirczliy/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.2469/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.2535/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.2727/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021121649" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/libvncserver-denial-of-service-via-hybireadanddecode-32873" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/158543/ubuntu-security-notice-usn-4434-1.html" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14400" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/4434-1" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14402" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14398" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14401" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14405" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14396" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14397" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20839" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "PACKETSTORM", "id": "158543" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "db": "PACKETSTORM", "id": "158543" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "db": "NVD", "id": "CVE-2019-20840" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-07-15T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "date": "2020-07-24T14:28:24", "db": "PACKETSTORM", "id": "158543" }, { "date": "2020-06-17T00:00:00", "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "date": "2020-06-17T16:15:11.523000", "db": "NVD", "id": "CVE-2019-20840" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-07-15T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-015658" }, { "date": "2021-12-17T00:00:00", "db": "CNNVD", "id": "CNNVD-202006-1177" }, { "date": "2024-11-21T04:39:30.203000", "db": "NVD", "id": "CVE-2019-20840" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "PACKETSTORM", "id": "158543" }, { "db": "CNNVD", "id": "CNNVD-202006-1177" } ], "trust": 0.7 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "LibVNCServer Buffer error vulnerability in", "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-015658" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202006-1177" } ], "trust": 0.6 } }
opensuse-su-2020:0988-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2020-988", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0988-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2020:0988-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RH2MWYCQ3Y7WV6I2GEEBEI2J57NGY36J/" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2020:0988-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RH2MWYCQ3Y7WV6I2GEEBEI2J57NGY36J/" }, { "category": "self", "summary": "SUSE Bug 1173477", "url": "https://bugzilla.suse.com/1173477" }, { "category": "self", "summary": "SUSE Bug 1173691", "url": "https://bugzilla.suse.com/1173691" }, { "category": "self", "summary": "SUSE Bug 1173694", "url": "https://bugzilla.suse.com/1173694" }, { "category": "self", "summary": "SUSE Bug 1173700", "url": "https://bugzilla.suse.com/1173700" }, { "category": "self", "summary": "SUSE Bug 1173701", "url": "https://bugzilla.suse.com/1173701" }, { "category": "self", "summary": "SUSE Bug 1173743", "url": "https://bugzilla.suse.com/1173743" }, { "category": "self", "summary": "SUSE Bug 1173874", "url": "https://bugzilla.suse.com/1173874" }, { "category": "self", "summary": "SUSE Bug 1173875", "url": "https://bugzilla.suse.com/1173875" }, { "category": "self", "summary": "SUSE Bug 1173876", "url": "https://bugzilla.suse.com/1173876" }, { "category": "self", "summary": "SUSE Bug 1173880", "url": "https://bugzilla.suse.com/1173880" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2020-07-18T12:27:09Z", "generator": { "date": "2020-07-18T12:27:09Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2020:0988-1", "initial_release_date": "2020-07-18T12:27:09Z", "revision_history": [ { "date": "2020-07-18T12:27:09Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "product": { "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "product_id": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp151.7.9.1.i586", "product": { "name": "libvncclient0-0.9.10-lp151.7.9.1.i586", "product_id": "libvncclient0-0.9.10-lp151.7.9.1.i586" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp151.7.9.1.i586", "product": { "name": "libvncserver0-0.9.10-lp151.7.9.1.i586", "product_id": "libvncserver0-0.9.10-lp151.7.9.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "product_id": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64", "product": { "name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64", "product_id": "libvncclient0-0.9.10-lp151.7.9.1.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64", "product": { "name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64", "product_id": "libvncserver0-0.9.10-lp151.7.9.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.1", "product": { "name": "openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586" }, "product_reference": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586" }, "product_reference": "libvncclient0-0.9.10-lp151.7.9.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64" }, "product_reference": "libvncclient0-0.9.10-lp151.7.9.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586" }, "product_reference": "libvncserver0-0.9.10-lp151.7.9.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" }, "product_reference": "libvncserver0-0.9.10-lp151.7.9.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586", "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-18T12:27:09Z", "details": "moderate" } ], "title": "CVE-2020-14402" } ] }
opensuse-su-2024:10598-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "LibVNCServer-devel-0.9.13-3.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10598", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10598-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2006-2450 page", "url": "https://www.suse.com/security/cve/CVE-2006-2450/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-15126 page", "url": "https://www.suse.com/security/cve/CVE-2018-15126/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-15127 page", "url": "https://www.suse.com/security/cve/CVE-2018-15127/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20019 page", "url": "https://www.suse.com/security/cve/CVE-2018-20019/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20020 page", "url": "https://www.suse.com/security/cve/CVE-2018-20020/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20021 page", "url": "https://www.suse.com/security/cve/CVE-2018-20021/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20022 page", "url": "https://www.suse.com/security/cve/CVE-2018-20022/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20023 page", "url": "https://www.suse.com/security/cve/CVE-2018-20023/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20024 page", "url": "https://www.suse.com/security/cve/CVE-2018-20024/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20748 page", "url": "https://www.suse.com/security/cve/CVE-2018-20748/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20749 page", "url": "https://www.suse.com/security/cve/CVE-2018-20749/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20750 page", "url": "https://www.suse.com/security/cve/CVE-2018-20750/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6307 page", "url": "https://www.suse.com/security/cve/CVE-2018-6307/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-7225 page", "url": "https://www.suse.com/security/cve/CVE-2018-7225/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15681 page", "url": "https://www.suse.com/security/cve/CVE-2019-15681/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15690 page", "url": "https://www.suse.com/security/cve/CVE-2019-15690/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20788 page", "url": "https://www.suse.com/security/cve/CVE-2019-20788/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14403 page", "url": "https://www.suse.com/security/cve/CVE-2020-14403/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14404 page", "url": "https://www.suse.com/security/cve/CVE-2020-14404/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-25708 page", "url": "https://www.suse.com/security/cve/CVE-2020-25708/" } ], "title": "LibVNCServer-devel-0.9.13-3.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10598-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.13-3.1.aarch64", "product": { "name": "LibVNCServer-devel-0.9.13-3.1.aarch64", "product_id": "LibVNCServer-devel-0.9.13-3.1.aarch64" } }, { "category": "product_version", "name": "libvncclient1-0.9.13-3.1.aarch64", "product": { "name": "libvncclient1-0.9.13-3.1.aarch64", "product_id": "libvncclient1-0.9.13-3.1.aarch64" } }, { "category": "product_version", "name": "libvncserver1-0.9.13-3.1.aarch64", "product": { "name": "libvncserver1-0.9.13-3.1.aarch64", "product_id": "libvncserver1-0.9.13-3.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.13-3.1.ppc64le", "product": { "name": "LibVNCServer-devel-0.9.13-3.1.ppc64le", "product_id": "LibVNCServer-devel-0.9.13-3.1.ppc64le" } }, { "category": "product_version", "name": "libvncclient1-0.9.13-3.1.ppc64le", "product": { "name": "libvncclient1-0.9.13-3.1.ppc64le", "product_id": "libvncclient1-0.9.13-3.1.ppc64le" } }, { "category": "product_version", "name": "libvncserver1-0.9.13-3.1.ppc64le", "product": { "name": "libvncserver1-0.9.13-3.1.ppc64le", "product_id": "libvncserver1-0.9.13-3.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.13-3.1.s390x", "product": { "name": "LibVNCServer-devel-0.9.13-3.1.s390x", "product_id": "LibVNCServer-devel-0.9.13-3.1.s390x" } }, { "category": "product_version", "name": "libvncclient1-0.9.13-3.1.s390x", "product": { "name": "libvncclient1-0.9.13-3.1.s390x", "product_id": "libvncclient1-0.9.13-3.1.s390x" } }, { "category": "product_version", "name": "libvncserver1-0.9.13-3.1.s390x", "product": { "name": "libvncserver1-0.9.13-3.1.s390x", "product_id": "libvncserver1-0.9.13-3.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.13-3.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.13-3.1.x86_64", "product_id": "LibVNCServer-devel-0.9.13-3.1.x86_64" } }, { "category": "product_version", "name": "libvncclient1-0.9.13-3.1.x86_64", "product": { "name": "libvncclient1-0.9.13-3.1.x86_64", "product_id": "libvncclient1-0.9.13-3.1.x86_64" } }, { "category": "product_version", "name": "libvncserver1-0.9.13-3.1.x86_64", "product": { "name": "libvncserver1-0.9.13-3.1.x86_64", "product_id": "libvncserver1-0.9.13-3.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64" }, "product_reference": "LibVNCServer-devel-0.9.13-3.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le" }, "product_reference": "LibVNCServer-devel-0.9.13-3.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.13-3.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x" }, "product_reference": "LibVNCServer-devel-0.9.13-3.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.13-3.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient1-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64" }, "product_reference": "libvncclient1-0.9.13-3.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient1-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le" }, "product_reference": "libvncclient1-0.9.13-3.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient1-0.9.13-3.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x" }, "product_reference": "libvncclient1-0.9.13-3.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient1-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64" }, "product_reference": "libvncclient1-0.9.13-3.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver1-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64" }, "product_reference": "libvncserver1-0.9.13-3.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver1-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le" }, "product_reference": "libvncserver1-0.9.13-3.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver1-0.9.13-3.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x" }, "product_reference": "libvncserver1-0.9.13-3.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver1-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" }, "product_reference": "libvncserver1-0.9.13-3.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2006-2450", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2006-2450" } ], "notes": [ { "category": "general", "text": "auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as \"Type 1 - None\", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2006-2450", "url": "https://www.suse.com/security/cve/CVE-2006-2450" }, { "category": "external", "summary": "SUSE Bug 184418 for CVE-2006-2450", "url": "https://bugzilla.suse.com/184418" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2006-2450" }, { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-15126", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-15126" } ], "notes": [ { "category": "general", "text": "LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-15126", "url": "https://www.suse.com/security/cve/CVE-2018-15126" }, { "category": "external", "summary": "SUSE Bug 1120114 for CVE-2018-15126", "url": "https://bugzilla.suse.com/1120114" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2018-15126" }, { "cve": "CVE-2018-15127", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-15127" } ], "notes": [ { "category": "general", "text": "LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-15127", "url": "https://www.suse.com/security/cve/CVE-2018-15127" }, { "category": "external", "summary": "SUSE Bug 1120117 for CVE-2018-15127", "url": "https://bugzilla.suse.com/1120117" }, { "category": "external", "summary": "SUSE Bug 1123828 for CVE-2018-15127", "url": "https://bugzilla.suse.com/1123828" }, { "category": "external", "summary": "SUSE Bug 1123832 for CVE-2018-15127", "url": "https://bugzilla.suse.com/1123832" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2018-15127" }, { "cve": "CVE-2018-20019", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20019" } ], "notes": [ { "category": "general", "text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20019", "url": "https://www.suse.com/security/cve/CVE-2018-20019" }, { "category": "external", "summary": "SUSE Bug 1120118 for CVE-2018-20019", "url": "https://bugzilla.suse.com/1120118" }, { "category": "external", "summary": "SUSE Bug 1123823 for CVE-2018-20019", "url": "https://bugzilla.suse.com/1123823" }, { "category": "external", "summary": "SUSE Bug 1155442 for CVE-2018-20019", "url": "https://bugzilla.suse.com/1155442" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-20019" }, { "cve": "CVE-2018-20020", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20020" } ], "notes": [ { "category": "general", "text": "LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20020", "url": "https://www.suse.com/security/cve/CVE-2018-20020" }, { "category": "external", "summary": "SUSE Bug 1120116 for CVE-2018-20020", "url": "https://bugzilla.suse.com/1120116" }, { "category": "external", "summary": "SUSE Bug 1155472 for CVE-2018-20020", "url": "https://bugzilla.suse.com/1155472" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-20020" }, { "cve": "CVE-2018-20021", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20021" } ], "notes": [ { "category": "general", "text": "LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20021", "url": "https://www.suse.com/security/cve/CVE-2018-20021" }, { "category": "external", "summary": "SUSE Bug 1120122 for CVE-2018-20021", "url": "https://bugzilla.suse.com/1120122" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-20021" }, { "cve": "CVE-2018-20022", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20022" } ], "notes": [ { "category": "general", "text": "LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20022", "url": "https://www.suse.com/security/cve/CVE-2018-20022" }, { "category": "external", "summary": "SUSE Bug 1120120 for CVE-2018-20022", "url": "https://bugzilla.suse.com/1120120" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-20022" }, { "cve": "CVE-2018-20023", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20023" } ], "notes": [ { "category": "general", "text": "LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20023", "url": "https://www.suse.com/security/cve/CVE-2018-20023" }, { "category": "external", "summary": "SUSE Bug 1120119 for CVE-2018-20023", "url": "https://bugzilla.suse.com/1120119" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-20023" }, { "cve": "CVE-2018-20024", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20024" } ], "notes": [ { "category": "general", "text": "LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20024", "url": "https://www.suse.com/security/cve/CVE-2018-20024" }, { "category": "external", "summary": "SUSE Bug 1120121 for CVE-2018-20024", "url": "https://bugzilla.suse.com/1120121" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-20024" }, { "cve": "CVE-2018-20748", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20748" } ], "notes": [ { "category": "general", "text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20748", "url": "https://www.suse.com/security/cve/CVE-2018-20748" }, { "category": "external", "summary": "SUSE Bug 1120118 for CVE-2018-20748", "url": "https://bugzilla.suse.com/1120118" }, { "category": "external", "summary": "SUSE Bug 1123823 for CVE-2018-20748", "url": "https://bugzilla.suse.com/1123823" }, { "category": "external", "summary": "SUSE Bug 1155442 for CVE-2018-20748", "url": "https://bugzilla.suse.com/1155442" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-20748" }, { "cve": "CVE-2018-20749", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20749" } ], "notes": [ { "category": "general", "text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20749", "url": "https://www.suse.com/security/cve/CVE-2018-20749" }, { "category": "external", "summary": "SUSE Bug 1120117 for CVE-2018-20749", "url": "https://bugzilla.suse.com/1120117" }, { "category": "external", "summary": "SUSE Bug 1123828 for CVE-2018-20749", "url": "https://bugzilla.suse.com/1123828" }, { "category": "external", "summary": "SUSE Bug 1123832 for CVE-2018-20749", "url": "https://bugzilla.suse.com/1123832" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2018-20749" }, { "cve": "CVE-2018-20750", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-20750" } ], "notes": [ { "category": "general", "text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-20750", "url": "https://www.suse.com/security/cve/CVE-2018-20750" }, { "category": "external", "summary": "SUSE Bug 1120117 for CVE-2018-20750", "url": "https://bugzilla.suse.com/1120117" }, { "category": "external", "summary": "SUSE Bug 1123832 for CVE-2018-20750", "url": "https://bugzilla.suse.com/1123832" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2018-20750" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2018-6307", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-6307" } ], "notes": [ { "category": "general", "text": "LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-6307", "url": "https://www.suse.com/security/cve/CVE-2018-6307" }, { "category": "external", "summary": "SUSE Bug 1120115 for CVE-2018-6307", "url": "https://bugzilla.suse.com/1120115" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2018-6307" }, { "cve": "CVE-2018-7225", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-7225" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-7225", "url": "https://www.suse.com/security/cve/CVE-2018-7225" }, { "category": "external", "summary": "SUSE Bug 1081493 for CVE-2018-7225", "url": "https://bugzilla.suse.com/1081493" }, { "category": "external", "summary": "SUSE Bug 1090647 for CVE-2018-7225", "url": "https://bugzilla.suse.com/1090647" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-7225" }, { "cve": "CVE-2019-15681", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15681" } ], "notes": [ { "category": "general", "text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15681", "url": "https://www.suse.com/security/cve/CVE-2019-15681" }, { "category": "external", "summary": "SUSE Bug 1155419 for CVE-2019-15681", "url": "https://bugzilla.suse.com/1155419" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-15681" }, { "cve": "CVE-2019-15690", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-15690" } ], "notes": [ { "category": "general", "text": "LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-15690", "url": "https://www.suse.com/security/cve/CVE-2019-15690" }, { "category": "external", "summary": "SUSE Bug 1160471 for CVE-2019-15690", "url": "https://bugzilla.suse.com/1160471" }, { "category": "external", "summary": "SUSE Bug 1170441 for CVE-2019-15690", "url": "https://bugzilla.suse.com/1170441" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2019-15690" }, { "cve": "CVE-2019-20788", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20788" } ], "notes": [ { "category": "general", "text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20788", "url": "https://www.suse.com/security/cve/CVE-2019-20788" }, { "category": "external", "summary": "SUSE Bug 1170441 for CVE-2019-20788", "url": "https://bugzilla.suse.com/1170441" }, { "category": "external", "summary": "SUSE Bug 1173698 for CVE-2019-20788", "url": "https://bugzilla.suse.com/1173698" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2019-20788" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14402" }, { "cve": "CVE-2020-14403", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14403" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14403", "url": "https://www.suse.com/security/cve/CVE-2020-14403" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14403", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14403" }, { "cve": "CVE-2020-14404", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14404" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14404", "url": "https://www.suse.com/security/cve/CVE-2020-14404" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14404", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2020-14404" }, { "cve": "CVE-2020-25708", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-25708" } ], "notes": [ { "category": "general", "text": "A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-25708", "url": "https://www.suse.com/security/cve/CVE-2020-25708" }, { "category": "external", "summary": "SUSE Bug 1178682 for CVE-2020-25708", "url": "https://bugzilla.suse.com/1178682" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x", "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x", "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2020-25708" } ] }
opensuse-su-2020:1025-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2020-1025", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1025-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2020:1025-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MRXTN4MBX2MAHYVC2KCQATTKYECU2TZT/" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2020:1025-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MRXTN4MBX2MAHYVC2KCQATTKYECU2TZT/" }, { "category": "self", "summary": "SUSE Bug 1173477", "url": "https://bugzilla.suse.com/1173477" }, { "category": "self", "summary": "SUSE Bug 1173691", "url": "https://bugzilla.suse.com/1173691" }, { "category": "self", "summary": "SUSE Bug 1173694", "url": "https://bugzilla.suse.com/1173694" }, { "category": "self", "summary": "SUSE Bug 1173700", "url": "https://bugzilla.suse.com/1173700" }, { "category": "self", "summary": "SUSE Bug 1173701", "url": "https://bugzilla.suse.com/1173701" }, { "category": "self", "summary": "SUSE Bug 1173743", "url": "https://bugzilla.suse.com/1173743" }, { "category": "self", "summary": "SUSE Bug 1173874", "url": "https://bugzilla.suse.com/1173874" }, { "category": "self", "summary": "SUSE Bug 1173875", "url": "https://bugzilla.suse.com/1173875" }, { "category": "self", "summary": "SUSE Bug 1173876", "url": "https://bugzilla.suse.com/1173876" }, { "category": "self", "summary": "SUSE Bug 1173880", "url": "https://bugzilla.suse.com/1173880" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2020-07-21T08:27:26Z", "generator": { "date": "2020-07-21T08:27:26Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2020:1025-1", "initial_release_date": "2020-07-21T08:27:26Z", "revision_history": [ { "date": "2020-07-21T08:27:26Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "product": { "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "product_id": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp152.9.8.1.i586", "product": { "name": "libvncclient0-0.9.10-lp152.9.8.1.i586", "product_id": "libvncclient0-0.9.10-lp152.9.8.1.i586" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp152.9.8.1.i586", "product": { "name": "libvncserver0-0.9.10-lp152.9.8.1.i586", "product_id": "libvncserver0-0.9.10-lp152.9.8.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "product_id": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64", "product": { "name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64", "product_id": "libvncclient0-0.9.10-lp152.9.8.1.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64", "product": { "name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64", "product_id": "libvncserver0-0.9.10-lp152.9.8.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.2", "product": { "name": "openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.2" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586" }, "product_reference": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586" }, "product_reference": "libvncclient0-0.9.10-lp152.9.8.1.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64" }, "product_reference": "libvncclient0-0.9.10-lp152.9.8.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586" }, "product_reference": "libvncserver0-0.9.10-lp152.9.8.1.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" }, "product_reference": "libvncserver0-0.9.10-lp152.9.8.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-21T08:27:26Z", "details": "moderate" } ], "title": "CVE-2020-14402" } ] }
opensuse-su-2020:1056-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2020-1056", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1056-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2020:1056-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWRQ72I3AY52E4KTKKWCJGWKFGVHI5FP/" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2020:1056-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWRQ72I3AY52E4KTKKWCJGWKFGVHI5FP/" }, { "category": "self", "summary": "SUSE Bug 1173477", "url": "https://bugzilla.suse.com/1173477" }, { "category": "self", "summary": "SUSE Bug 1173691", "url": "https://bugzilla.suse.com/1173691" }, { "category": "self", "summary": "SUSE Bug 1173694", "url": "https://bugzilla.suse.com/1173694" }, { "category": "self", "summary": "SUSE Bug 1173700", "url": "https://bugzilla.suse.com/1173700" }, { "category": "self", "summary": "SUSE Bug 1173701", "url": "https://bugzilla.suse.com/1173701" }, { "category": "self", "summary": "SUSE Bug 1173743", "url": "https://bugzilla.suse.com/1173743" }, { "category": "self", "summary": "SUSE Bug 1173874", "url": "https://bugzilla.suse.com/1173874" }, { "category": "self", "summary": "SUSE Bug 1173875", "url": "https://bugzilla.suse.com/1173875" }, { "category": "self", "summary": "SUSE Bug 1173876", "url": "https://bugzilla.suse.com/1173876" }, { "category": "self", "summary": "SUSE Bug 1173880", "url": "https://bugzilla.suse.com/1173880" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2020-07-24T12:20:15Z", "generator": { "date": "2020-07-24T12:20:15Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2020:1056-1", "initial_release_date": "2020-07-24T12:20:15Z", "revision_history": [ { "date": "2020-07-24T12:20:15Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "product": { "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "product_id": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp152.9.4.2.i586", "product": { "name": "libvncclient0-0.9.10-lp152.9.4.2.i586", "product_id": "libvncclient0-0.9.10-lp152.9.4.2.i586" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp152.9.4.2.i586", "product": { "name": "libvncserver0-0.9.10-lp152.9.4.2.i586", "product_id": "libvncserver0-0.9.10-lp152.9.4.2.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "product": { "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "product_id": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64", "product": { "name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64", "product_id": "libvncclient0-0.9.10-lp152.9.4.2.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64", "product": { "name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64", "product_id": "libvncserver0-0.9.10-lp152.9.4.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.2", "product": { "name": "openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.2" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586" }, "product_reference": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586" }, "product_reference": "libvncclient0-0.9.10-lp152.9.4.2.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64" }, "product_reference": "libvncclient0-0.9.10-lp152.9.4.2.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586" }, "product_reference": "libvncserver0-0.9.10-lp152.9.4.2.i586", "relates_to_product_reference": "openSUSE Leap 15.2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2", "product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" }, "product_reference": "libvncserver0-0.9.10-lp152.9.4.2.x86_64", "relates_to_product_reference": "openSUSE Leap 15.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586", "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-24T12:20:15Z", "details": "moderate" } ], "title": "CVE-2020-14402" } ] }
ghsa-42fc-843w-r7rp
Vulnerability from github
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
{ "affected": [], "aliases": [ "CVE-2019-20840" ], "database_specific": { "cwe_ids": [ "CWE-119", "CWE-787" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2020-06-17T16:15:00Z", "severity": "MODERATE" }, "details": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "id": "GHSA-42fc-843w-r7rp", "modified": "2022-05-24T17:20:41Z", "published": "2022-05-24T17:20:41Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20840" }, { "type": "WEB", "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "type": "WEB", "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4434-1" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
fkie_cve-2019-20840
Vulnerability from fkie_nvd
Vendor | Product | Version | |
---|---|---|---|
libvnc_project | libvncserver | * | |
canonical | ubuntu_linux | 14.04 | |
canonical | ubuntu_linux | 16.04 | |
canonical | ubuntu_linux | 16.04 | |
canonical | ubuntu_linux | 18.04 | |
canonical | ubuntu_linux | 18.10 | |
canonical | ubuntu_linux | 20.04 | |
debian | debian_linux | 8.0 | |
debian | debian_linux | 9.0 | |
siemens | simatic_itc1500_firmware | * | |
siemens | simatic_itc1500 | - | |
siemens | simatic_itc1500_pro_firmware | * | |
siemens | simatic_itc1500_pro | - | |
siemens | simatic_itc1900_firmware | * | |
siemens | simatic_itc1900 | - | |
siemens | simatic_itc1900_pro_firmware | * | |
siemens | simatic_itc1900_pro | - | |
siemens | simatic_itc2200_firmware | * | |
siemens | simatic_itc2200 | - | |
siemens | simatic_itc2200_pro_firmware | * | |
siemens | simatic_itc2200_pro | - | |
opensuse | leap | 15.2 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "A03A7282-D445-4E26-98A0-6A1597838D35", "versionEndIncluding": "0.9.12", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F", "vulnerable": true }, { "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true }, { "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A664216-EEA0-423F-8E11-59C746FDEEFE", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*", "matchCriteriaId": "9596C8CD-B03F-4E9D-82AB-0986FDD1B47C", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD78291E-48D8-4718-AE14-BDF93BD557D7", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "5BB898D3-07A3-42A1-8F1B-53C3B005982D", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD1209DE-2724-493D-8276-1BE959BFE6BF", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A9143A6-A93A-45CA-8A1F-6EE30647B54A", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "92F7FC17-F19F-4BD6-9704-49B67D22B532", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D34BD13-4E71-48A2-851D-AE7CE2A03C28", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE4A6F13-385B-4A13-B8D8-3BBC4E9D5B67", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*", "matchCriteriaId": "3E63E423-7450-4043-B33B-3FFF5BBE1CB2", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "71A51CA4-1A62-47BC-99A3-4DC9F3986FF5", "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD278558-AB0E-4FC1-9E5B-6B57D29CB86A", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode." }, { "lang": "es", "value": "Se detect\u00f3 un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/ws_decode.c puede conllevar a un bloqueo debido a accesos no alineados en la funci\u00f3n hybiReadAndDecode" } ], "id": "CVE-2019-20840", "lastModified": "2024-11-21T04:39:30.203", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2020-06-17T16:15:11.523", "references": [ { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "source": "cve@mitre.org", "tags": [ "Release Notes", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4434-1/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Release Notes", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4434-1/" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-787" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
cnvd-2020-36781
Vulnerability from cnvd
Title: LibVNCServer缓冲区溢出漏洞(CNVD-2020-36781)
Description:
LibVNCServer是一款支持在程序中实现VNC(虚拟网络计算)服务器或客户端功能的跨平台C语言库。
LibVNCServer 0.9.13之前版本中的libvncserver/ws_decode.c文件的‘hybiReadAndDecode’函数存在安全漏洞。攻击者可利用该漏洞导致拒绝服务(崩溃)。
Severity: 中
Patch Name: LibVNCServer缓冲区溢出漏洞(CNVD-2020-36781)的补丁
Patch Description:
LibVNCServer是一款支持在程序中实现VNC(虚拟网络计算)服务器或客户端功能的跨平台C语言库。
LibVNCServer 0.9.13之前版本中的libvncserver/ws_decode.c文件的‘hybiReadAndDecode’函数存在安全漏洞。攻击者可利用该漏洞导致拒绝服务(崩溃)。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description:
目前厂商已发布升级补丁以修复漏洞,补丁获取链接: https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-20840
Name | LibVNCServer LibVNCServer <0.9.13 |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2019-20840" } }, "description": "LibVNCServer\u662f\u4e00\u6b3e\u652f\u6301\u5728\u7a0b\u5e8f\u4e2d\u5b9e\u73b0VNC\uff08\u865a\u62df\u7f51\u7edc\u8ba1\u7b97\uff09\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u529f\u80fd\u7684\u8de8\u5e73\u53f0C\u8bed\u8a00\u5e93\u3002\n\nLibVNCServer 0.9.13\u4e4b\u524d\u7248\u672c\u4e2d\u7684libvncserver/ws_decode.c\u6587\u4ef6\u7684\u2018hybiReadAndDecode\u2019\u51fd\u6570\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\uff08\u5d29\u6e83\uff09\u3002", "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2020-36781", "openTime": "2020-07-07", "patchDescription": "LibVNCServer\u662f\u4e00\u6b3e\u652f\u6301\u5728\u7a0b\u5e8f\u4e2d\u5b9e\u73b0VNC\uff08\u865a\u62df\u7f51\u7edc\u8ba1\u7b97\uff09\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u529f\u80fd\u7684\u8de8\u5e73\u53f0C\u8bed\u8a00\u5e93\u3002\r\n\r\nLibVNCServer 0.9.13\u4e4b\u524d\u7248\u672c\u4e2d\u7684libvncserver/ws_decode.c\u6587\u4ef6\u7684\u2018hybiReadAndDecode\u2019\u51fd\u6570\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\uff08\u5d29\u6e83\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "LibVNCServer\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-36781\uff09\u7684\u8865\u4e01", "products": { "product": "LibVNCServer LibVNCServer \u003c0.9.13" }, "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-20840", "serverity": "\u4e2d", "submitTime": "2020-06-18", "title": "LibVNCServer\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-36781\uff09" }
icsa-21-350-12
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.", "title": "Risk evaluation" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-390195.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-350-12 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-350-12.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-350-12 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-12" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" }, { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-390195.txt" } ], "title": "Siemens SIMATIC ITC", "tracking": { "current_release_date": "2021-12-16T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-21-350-12", "initial_release_date": "2021-12-16T00:00:00.000000Z", "revision_history": [ { "date": "2021-12-16T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-21-350-12 Siemens SIMATIC ITC" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1500 V3", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SIMATIC ITC1500 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1500 V3 PRO", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "SIMATIC ITC1500 V3 PRO" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1900 V3", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": "SIMATIC ITC1900 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1900 V3 PRO", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "SIMATIC ITC1900 V3 PRO" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC2200 V3", "product_id": "CSAFPID-0005" } } ], "category": "product_name", "name": "SIMATIC ITC2200 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC2200 V3 PRO", "product_id": "CSAFPID-0006" } } ], "category": "product_name", "name": "SIMATIC ITC2200 V3 PRO" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2017-18922 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2017-18922.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18922" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20019" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20748" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20750" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-21247" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15681" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15690" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20788" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20839" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14396" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14397" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14398" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14401" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14402" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14403" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14404" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14405" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-20019", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20019 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20019.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20019" }, { "cve": "CVE-2018-20748", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20748 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20748.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20748" }, { "cve": "CVE-2018-20749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20749 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20749.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20749" }, { "cve": "CVE-2018-20750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20750 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20750.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20750" }, { "cve": "CVE-2018-21247", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-21247 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-21247.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-15681", "cwe": { "id": "CWE-665", "name": "Improper Initialization" }, "notes": [ { "category": "summary", "text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-15681 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15681.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-15681" }, { "cve": "CVE-2019-15690", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "A flaw was found in libvncserver. An integer overflow within the HandleCursorShape() function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted dimensions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-15690 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15690.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-15690" }, { "cve": "CVE-2019-20788", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20788 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20788.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20788" }, { "cve": "CVE-2019-20839", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "notes": [ { "category": "summary", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20839 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20839.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20840 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20840.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14396", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14396 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14396.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14396" }, { "cve": "CVE-2020-14397", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14397 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14397.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14398 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14398.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14401", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14401 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14401.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14402 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14402.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14402" }, { "cve": "CVE-2020-14403", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14403 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14403.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14403" }, { "cve": "CVE-2020-14404", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14404 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14404.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14404" }, { "cve": "CVE-2020-14405", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14405 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14405.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14405" } ] }
ICSA-21-350-12
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.", "title": "Risk evaluation" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-390195.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-350-12 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-350-12.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-350-12 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-12" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" }, { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" }, { "category": "external", "summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-390195.txt" } ], "title": "Siemens SIMATIC ITC", "tracking": { "current_release_date": "2021-12-16T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-21-350-12", "initial_release_date": "2021-12-16T00:00:00.000000Z", "revision_history": [ { "date": "2021-12-16T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-21-350-12 Siemens SIMATIC ITC" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1500 V3", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SIMATIC ITC1500 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1500 V3 PRO", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "SIMATIC ITC1500 V3 PRO" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1900 V3", "product_id": "CSAFPID-0003" } } ], "category": "product_name", "name": "SIMATIC ITC1900 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC1900 V3 PRO", "product_id": "CSAFPID-0004" } } ], "category": "product_name", "name": "SIMATIC ITC1900 V3 PRO" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC2200 V3", "product_id": "CSAFPID-0005" } } ], "category": "product_name", "name": "SIMATIC ITC2200 V3" }, { "branches": [ { "category": "product_version_range", "name": "\u003c V3.2.1.0", "product": { "name": "SIMATIC ITC2200 V3 PRO", "product_id": "CSAFPID-0006" } } ], "category": "product_name", "name": "SIMATIC ITC2200 V3 PRO" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2017-18922 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2017-18922 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2017-18922.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18922" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20019" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20748" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20749" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20750" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-21247" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15681" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15690" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20788" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20839" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20840" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14396" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14397" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14398" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14401" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14402" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14403" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14404" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14405" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-20019", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20019 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20019 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20019.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20019" }, { "cve": "CVE-2018-20748", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20748 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20748 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20748.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20748" }, { "cve": "CVE-2018-20749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20749 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20749 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20749.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20749" }, { "cve": "CVE-2018-20750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-20750 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-20750 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20750.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-20750" }, { "cve": "CVE-2018-21247", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2018-21247 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2018-21247 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-21247.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-15681", "cwe": { "id": "CWE-665", "name": "Improper Initialization" }, "notes": [ { "category": "summary", "text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-15681 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15681 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15681.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-15681" }, { "cve": "CVE-2019-15690", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "A flaw was found in libvncserver. An integer overflow within the HandleCursorShape() function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted dimensions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-15690 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-15690 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15690.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-15690" }, { "cve": "CVE-2019-20788", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20788 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20788 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20788.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20788" }, { "cve": "CVE-2019-20839", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "notes": [ { "category": "summary", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20839 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20839 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20839.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2019-20840 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2019-20840 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20840.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14396", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14396 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14396 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14396.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14396" }, { "cve": "CVE-2020-14397", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14397 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14397 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14397.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14398 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14398 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14398.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14401", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14401 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14401 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14401.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14402 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14402 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14402.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14402" }, { "cve": "CVE-2020-14403", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14403 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14403 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14403.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14403" }, { "cve": "CVE-2020-14404", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14404 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14404 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14404.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14404" }, { "cve": "CVE-2020-14405", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, "references": [ { "summary": "CVE-2020-14405 - SIMATIC ITC1500 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1500 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1900 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC1900 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC2200 V3", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 - SIMATIC ITC2200 V3 PRO", "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "summary": "CVE-2020-14405 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14405.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.2.1.0 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/" }, { "category": "mitigation", "details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004", "CSAFPID-0005", "CSAFPID-0006" ] } ], "title": "CVE-2020-14405" } ] }
suse-su-2020:1922-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP1-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2020-1922,SUSE-SLE-Product-WE-15-SP1-2020-1922,SUSE-SLE-Product-WE-15-SP2-2020-1922", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1922-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2020:1922-1", "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20201922-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2020:1922-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-July/007136.html" }, { "category": "self", "summary": "SUSE Bug 1173477", "url": "https://bugzilla.suse.com/1173477" }, { "category": "self", "summary": "SUSE Bug 1173691", "url": "https://bugzilla.suse.com/1173691" }, { "category": "self", "summary": "SUSE Bug 1173694", "url": "https://bugzilla.suse.com/1173694" }, { "category": "self", "summary": "SUSE Bug 1173700", "url": "https://bugzilla.suse.com/1173700" }, { "category": "self", "summary": "SUSE Bug 1173701", "url": "https://bugzilla.suse.com/1173701" }, { "category": "self", "summary": "SUSE Bug 1173743", "url": "https://bugzilla.suse.com/1173743" }, { "category": "self", "summary": "SUSE Bug 1173874", "url": "https://bugzilla.suse.com/1173874" }, { "category": "self", "summary": "SUSE Bug 1173875", "url": "https://bugzilla.suse.com/1173875" }, { "category": "self", "summary": "SUSE Bug 1173876", "url": "https://bugzilla.suse.com/1173876" }, { "category": "self", "summary": "SUSE Bug 1173880", "url": "https://bugzilla.suse.com/1173880" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2020-07-15T09:31:09Z", "generator": { "date": "2020-07-15T09:31:09Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2020:1922-1", "initial_release_date": "2020-07-15T09:31:09Z", "revision_history": [ { "date": "2020-07-15T09:31:09Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-4.22.1.aarch64", "product": { "name": "LibVNCServer-devel-0.9.10-4.22.1.aarch64", "product_id": "LibVNCServer-devel-0.9.10-4.22.1.aarch64" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-4.22.1.aarch64", "product": { "name": "libvncclient0-0.9.10-4.22.1.aarch64", "product_id": "libvncclient0-0.9.10-4.22.1.aarch64" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-4.22.1.aarch64", "product": { "name": "libvncserver0-0.9.10-4.22.1.aarch64", "product_id": "libvncserver0-0.9.10-4.22.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-4.22.1.i586", "product": { "name": "LibVNCServer-devel-0.9.10-4.22.1.i586", "product_id": "LibVNCServer-devel-0.9.10-4.22.1.i586" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-4.22.1.i586", "product": { "name": "libvncclient0-0.9.10-4.22.1.i586", "product_id": "libvncclient0-0.9.10-4.22.1.i586" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-4.22.1.i586", "product": { "name": "libvncserver0-0.9.10-4.22.1.i586", "product_id": "libvncserver0-0.9.10-4.22.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le", "product": { "name": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le", "product_id": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-4.22.1.ppc64le", "product": { "name": "libvncclient0-0.9.10-4.22.1.ppc64le", "product_id": "libvncclient0-0.9.10-4.22.1.ppc64le" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-4.22.1.ppc64le", "product": { "name": "libvncserver0-0.9.10-4.22.1.ppc64le", "product_id": "libvncserver0-0.9.10-4.22.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-4.22.1.s390x", "product": { "name": "LibVNCServer-devel-0.9.10-4.22.1.s390x", "product_id": "LibVNCServer-devel-0.9.10-4.22.1.s390x" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-4.22.1.s390x", "product": { "name": "libvncclient0-0.9.10-4.22.1.s390x", "product_id": "libvncclient0-0.9.10-4.22.1.s390x" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-4.22.1.s390x", "product": { "name": "libvncserver0-0.9.10-4.22.1.s390x", "product_id": "libvncserver0-0.9.10-4.22.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.10-4.22.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.10-4.22.1.x86_64", "product_id": "LibVNCServer-devel-0.9.10-4.22.1.x86_64" } }, { "category": "product_version", "name": "libvncclient0-0.9.10-4.22.1.x86_64", "product": { "name": "libvncclient0-0.9.10-4.22.1.x86_64", "product_id": "libvncclient0-0.9.10-4.22.1.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.10-4.22.1.x86_64", "product": { "name": "libvncserver0-0.9.10-4.22.1.x86_64", "product_id": "libvncserver0-0.9.10-4.22.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Package Hub 15 SP1", "product": { "name": "SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:packagehub:15:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Module for Package Hub 15 SP2", "product": { "name": "SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:packagehub:15:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Workstation Extension 15 SP1", "product": { "name": "SUSE Linux Enterprise Workstation Extension 15 SP1", "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-we:15:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Workstation Extension 15 SP2", "product": { "name": "SUSE Linux Enterprise Workstation Extension 15 SP2", "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-we:15:sp2" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64" }, "product_reference": "libvncserver0-0.9.10-4.22.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le" }, "product_reference": "libvncserver0-0.9.10-4.22.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x" }, "product_reference": "libvncserver0-0.9.10-4.22.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP1", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64" }, "product_reference": "libvncserver0-0.9.10-4.22.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64" }, "product_reference": "libvncserver0-0.9.10-4.22.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le" }, "product_reference": "libvncserver0-0.9.10-4.22.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x" }, "product_reference": "libvncserver0-0.9.10-4.22.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP2", "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" }, "product_reference": "libvncserver0-0.9.10-4.22.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP1", "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64" }, "product_reference": "libvncclient0-0.9.10-4.22.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP2", "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64" }, "product_reference": "libvncclient0-0.9.10-4.22.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP2", "product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" }, "product_reference": "libvncserver0-0.9.10-4.22.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP2" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64", "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-07-15T09:31:09Z", "details": "moderate" } ], "title": "CVE-2020-14402" } ] }
suse-su-2020:2167-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for LibVNCServer", "title": "Title of the patch" }, { "category": "description", "text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n", "title": "Description of the patch" }, { "category": "details", "text": "HPE-Helion-OpenStack-8-2020-2167,SUSE-2020-2167,SUSE-OpenStack-Cloud-7-2020-2167,SUSE-OpenStack-Cloud-8-2020-2167,SUSE-OpenStack-Cloud-9-2020-2167,SUSE-OpenStack-Cloud-Crowbar-8-2020-2167,SUSE-OpenStack-Cloud-Crowbar-9-2020-2167,SUSE-SLE-SAP-12-SP2-2020-2167,SUSE-SLE-SAP-12-SP3-2020-2167,SUSE-SLE-SAP-12-SP4-2020-2167,SUSE-SLE-SDK-12-SP5-2020-2167,SUSE-SLE-SERVER-12-SP2-2020-2167,SUSE-SLE-SERVER-12-SP2-BCL-2020-2167,SUSE-SLE-SERVER-12-SP3-2020-2167,SUSE-SLE-SERVER-12-SP3-BCL-2020-2167,SUSE-SLE-SERVER-12-SP4-LTSS-2020-2167,SUSE-SLE-SERVER-12-SP5-2020-2167,SUSE-Storage-5-2020-2167", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_2167-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2020:2167-1", "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20202167-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2020:2167-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-August/007241.html" }, { "category": "self", "summary": "SUSE Bug 1173477", "url": "https://bugzilla.suse.com/1173477" }, { "category": "self", "summary": "SUSE Bug 1173691", "url": "https://bugzilla.suse.com/1173691" }, { "category": "self", "summary": "SUSE Bug 1173694", "url": "https://bugzilla.suse.com/1173694" }, { "category": "self", "summary": "SUSE Bug 1173700", "url": "https://bugzilla.suse.com/1173700" }, { "category": "self", "summary": "SUSE Bug 1173701", "url": "https://bugzilla.suse.com/1173701" }, { "category": "self", "summary": "SUSE Bug 1173743", "url": "https://bugzilla.suse.com/1173743" }, { "category": "self", "summary": "SUSE Bug 1173874", "url": "https://bugzilla.suse.com/1173874" }, { "category": "self", "summary": "SUSE Bug 1173875", "url": "https://bugzilla.suse.com/1173875" }, { "category": "self", "summary": "SUSE Bug 1173876", "url": "https://bugzilla.suse.com/1173876" }, { "category": "self", "summary": "SUSE Bug 1173880", "url": "https://bugzilla.suse.com/1173880" }, { "category": "self", "summary": "SUSE CVE CVE-2017-18922 page", "url": "https://www.suse.com/security/cve/CVE-2017-18922/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-21247 page", "url": "https://www.suse.com/security/cve/CVE-2018-21247/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20839 page", "url": "https://www.suse.com/security/cve/CVE-2019-20839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20840 page", "url": "https://www.suse.com/security/cve/CVE-2019-20840/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14397 page", "url": "https://www.suse.com/security/cve/CVE-2020-14397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14398 page", "url": "https://www.suse.com/security/cve/CVE-2020-14398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14399 page", "url": "https://www.suse.com/security/cve/CVE-2020-14399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14400 page", "url": "https://www.suse.com/security/cve/CVE-2020-14400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14401 page", "url": "https://www.suse.com/security/cve/CVE-2020-14401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14402 page", "url": "https://www.suse.com/security/cve/CVE-2020-14402/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14403 page", "url": "https://www.suse.com/security/cve/CVE-2020-14403/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-14404 page", "url": "https://www.suse.com/security/cve/CVE-2020-14404/" } ], "title": "Security update for LibVNCServer", "tracking": { "current_release_date": "2020-08-07T12:54:44Z", "generator": { "date": "2020-08-07T12:54:44Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2020:2167-1", "initial_release_date": "2020-08-07T12:54:44Z", "revision_history": [ { "date": "2020-08-07T12:54:44Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.aarch64" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.aarch64", "product": { "name": "libvncclient0-0.9.9-17.31.1.aarch64", "product_id": "libvncclient0-0.9.9-17.31.1.aarch64" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.aarch64", "product": { "name": "libvncserver0-0.9.9-17.31.1.aarch64", "product_id": "libvncserver0-0.9.9-17.31.1.aarch64" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.aarch64", "product": { "name": "linuxvnc-0.9.9-17.31.1.aarch64", "product_id": "linuxvnc-0.9.9-17.31.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.i586", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.i586", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.i586" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.i586", "product": { "name": "libvncclient0-0.9.9-17.31.1.i586", "product_id": "libvncclient0-0.9.9-17.31.1.i586" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.i586", "product": { "name": "libvncserver0-0.9.9-17.31.1.i586", "product_id": "libvncserver0-0.9.9-17.31.1.i586" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.i586", "product": { "name": "linuxvnc-0.9.9-17.31.1.i586", "product_id": "linuxvnc-0.9.9-17.31.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.ppc64le", "product": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le", "product_id": "libvncclient0-0.9.9-17.31.1.ppc64le" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.ppc64le", "product": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le", "product_id": "libvncserver0-0.9.9-17.31.1.ppc64le" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.ppc64le", "product": { "name": "linuxvnc-0.9.9-17.31.1.ppc64le", "product_id": "linuxvnc-0.9.9-17.31.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.s390", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.s390", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.s390" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.s390", "product": { "name": "libvncclient0-0.9.9-17.31.1.s390", "product_id": "libvncclient0-0.9.9-17.31.1.s390" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.s390", "product": { "name": "libvncserver0-0.9.9-17.31.1.s390", "product_id": "libvncserver0-0.9.9-17.31.1.s390" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.s390", "product": { "name": "linuxvnc-0.9.9-17.31.1.s390", "product_id": "linuxvnc-0.9.9-17.31.1.s390" } } ], "category": "architecture", "name": "s390" }, { "branches": [ { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.s390x", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.s390x", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.s390x" } }, { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.s390x", "product": { "name": "libvncclient0-0.9.9-17.31.1.s390x", "product_id": "libvncclient0-0.9.9-17.31.1.s390x" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.s390x", "product": { "name": "libvncserver0-0.9.9-17.31.1.s390x", "product_id": "libvncserver0-0.9.9-17.31.1.s390x" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.s390x", "product": { "name": "linuxvnc-0.9.9-17.31.1.s390x", "product_id": "linuxvnc-0.9.9-17.31.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libvncclient0-0.9.9-17.31.1.x86_64", "product": { "name": "libvncclient0-0.9.9-17.31.1.x86_64", "product_id": "libvncclient0-0.9.9-17.31.1.x86_64" } }, { "category": "product_version", "name": "libvncserver0-0.9.9-17.31.1.x86_64", "product": { "name": "libvncserver0-0.9.9-17.31.1.x86_64", "product_id": "libvncserver0-0.9.9-17.31.1.x86_64" } }, { "category": "product_version", "name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64", "product": { "name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64", "product_id": "LibVNCServer-devel-0.9.9-17.31.1.x86_64" } }, { "category": "product_version", "name": "linuxvnc-0.9.9-17.31.1.x86_64", "product": { "name": "linuxvnc-0.9.9-17.31.1.x86_64", "product_id": "linuxvnc-0.9.9-17.31.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "HPE Helion OpenStack 8", "product": { "name": "HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8", "product_identification_helper": { "cpe": "cpe:/o:suse:hpe-helion-openstack:8" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud 7", "product": { "name": "SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:7" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud 8", "product": { "name": "SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:8" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud 9", "product": { "name": "SUSE OpenStack Cloud 9", "product_id": "SUSE OpenStack Cloud 9", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:9" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud Crowbar 8", "product": { "name": "SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud Crowbar 9", "product": { "name": "SUSE OpenStack Cloud Crowbar 9", "product_id": "SUSE OpenStack Cloud Crowbar 9", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 12 SP5", "product": { "name": "SUSE Linux Enterprise Software Development Kit 12 SP5", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-sdk:12:sp5" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP2-BCL", "product": { "name": "SUSE Linux Enterprise Server 12 SP2-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-bcl:12:sp2" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP3-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP3-BCL", "product": { "name": "SUSE Linux Enterprise Server 12 SP3-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-bcl:12:sp3" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP4-LTSS", "product": { "name": "SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS", "product_identification_helper": { "cpe": "cpe:/o:suse:sles-ltss:12:sp4" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP5", "product": { "name": "SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp5" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp5" } } }, { "category": "product_name", "name": "SUSE Enterprise Storage 5", "product": { "name": "SUSE Enterprise Storage 5", "product_id": "SUSE Enterprise Storage 5", "product_identification_helper": { "cpe": "cpe:/o:suse:ses:5" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "HPE Helion OpenStack 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "HPE Helion OpenStack 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 7", "product_id": "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 7" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 9", "product_id": "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 9" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 9", "product_id": "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud 9" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9", "product_id": "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9", "product_id": "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le" }, "product_reference": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x" }, "product_reference": "LibVNCServer-devel-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64" }, "product_reference": "LibVNCServer-devel-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL", "product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS", "product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5", "product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncclient0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le" }, "product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x" }, "product_reference": "libvncserver0-0.9.9-17.31.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Enterprise Storage 5", "product_id": "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Enterprise Storage 5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Enterprise Storage 5", "product_id": "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncclient0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Enterprise Storage 5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Enterprise Storage 5", "product_id": "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.aarch64", "relates_to_product_reference": "SUSE Enterprise Storage 5" }, { "category": "default_component_of", "full_product_name": { "name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Enterprise Storage 5", "product_id": "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64" }, "product_reference": "libvncserver0-0.9.9-17.31.1.x86_64", "relates_to_product_reference": "SUSE Enterprise Storage 5" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-18922" } ], "notes": [ { "category": "general", "text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-18922", "url": "https://www.suse.com/security/cve/CVE-2017-18922" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2017-18922", "url": "https://bugzilla.suse.com/1173477" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "important" } ], "title": "CVE-2017-18922" }, { "cve": "CVE-2018-21247", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-21247" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-21247", "url": "https://www.suse.com/security/cve/CVE-2018-21247" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173874 for CVE-2018-21247", "url": "https://bugzilla.suse.com/1173874" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "important" } ], "title": "CVE-2018-21247" }, { "cve": "CVE-2019-20839", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20839" } ], "notes": [ { "category": "general", "text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20839", "url": "https://www.suse.com/security/cve/CVE-2019-20839" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173875 for CVE-2019-20839", "url": "https://bugzilla.suse.com/1173875" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "important" } ], "title": "CVE-2019-20839" }, { "cve": "CVE-2019-20840", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-20840" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-20840", "url": "https://www.suse.com/security/cve/CVE-2019-20840" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173876 for CVE-2019-20840", "url": "https://bugzilla.suse.com/1173876" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "important" } ], "title": "CVE-2019-20840" }, { "cve": "CVE-2020-14397", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14397" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14397", "url": "https://www.suse.com/security/cve/CVE-2020-14397" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173700 for CVE-2020-14397", "url": "https://bugzilla.suse.com/1173700" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14397" }, { "cve": "CVE-2020-14398", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14398" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14398", "url": "https://www.suse.com/security/cve/CVE-2020-14398" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173880 for CVE-2020-14398", "url": "https://bugzilla.suse.com/1173880" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14398" }, { "cve": "CVE-2020-14399", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14399" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14399", "url": "https://www.suse.com/security/cve/CVE-2020-14399" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173743 for CVE-2020-14399", "url": "https://bugzilla.suse.com/1173743" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14399" }, { "cve": "CVE-2020-14400", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14400" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14400", "url": "https://www.suse.com/security/cve/CVE-2020-14400" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173691 for CVE-2020-14400", "url": "https://bugzilla.suse.com/1173691" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14400" }, { "cve": "CVE-2020-14401", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14401" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14401", "url": "https://www.suse.com/security/cve/CVE-2020-14401" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173694 for CVE-2020-14401", "url": "https://bugzilla.suse.com/1173694" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14401" }, { "cve": "CVE-2020-14402", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14402" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14402", "url": "https://www.suse.com/security/cve/CVE-2020-14402" }, { "category": "external", "summary": "SUSE Bug 1173477 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173477" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14402", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14402" }, { "cve": "CVE-2020-14403", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14403" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14403", "url": "https://www.suse.com/security/cve/CVE-2020-14403" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14403", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14403" }, { "cve": "CVE-2020-14404", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-14404" } ], "notes": [ { "category": "general", "text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2020-14404", "url": "https://www.suse.com/security/cve/CVE-2020-14404" }, { "category": "external", "summary": "SUSE Bug 1173701 for CVE-2020-14404", "url": "https://bugzilla.suse.com/1173701" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64", "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x", "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64", "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-08-07T12:54:44Z", "details": "moderate" } ], "title": "CVE-2020-14404" } ] }
gsd-2019-20840
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2019-20840", "description": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "id": "GSD-2019-20840", "references": [ "https://www.suse.com/security/cve/CVE-2019-20840.html", "https://ubuntu.com/security/CVE-2019-20840" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-20840" ], "details": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.", "id": "GSD-2019-20840", "modified": "2023-12-13T01:23:42.919437Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-20840", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13", "refsource": "MISC", "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "name": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76", "refsource": "MISC", "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "name": "FEDORA-2020-1a4b1c8271", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "name": "openSUSE-SU-2020:0988", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "name": "openSUSE-SU-2020:1025", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "name": "openSUSE-SU-2020:1056", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "name": "USN-4434-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4434-1/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "0.9.12", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.2.1.0", "versionStartIncluding": "3.0.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-20840" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-787" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13", "refsource": "MISC", "tags": [ "Release Notes", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13" }, { "name": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76" }, { "name": "FEDORA-2020-1a4b1c8271", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/" }, { "name": "openSUSE-SU-2020:0988", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html" }, { "name": "openSUSE-SU-2020:1025", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html" }, { "name": "openSUSE-SU-2020:1056", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html" }, { "name": "USN-4434-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "https://usn.ubuntu.com/4434-1/" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf", "refsource": "CONFIRM", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2022-03-10T15:23Z", "publishedDate": "2020-06-17T16:15Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.