Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-14397 (GCVE-0-2020-14397)
Vulnerability from cvelistv5
Published
2020-06-17 15:13
Modified
2024-08-04 12:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:46:34.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"name": "[debian-lts-announce] 20200630 [SECURITY] [DLA 2264-1] libvncserver security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"name": "openSUSE-SU-2020:0988",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"name": "openSUSE-SU-2020:1025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"name": "openSUSE-SU-2020:1056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"name": "USN-4434-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"name": "[debian-lts-announce] 20200828 [SECURITY] [DLA 2347-1] libvncserver security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"name": "USN-4573-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-14T13:06:32",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"name": "[debian-lts-announce] 20200630 [SECURITY] [DLA 2264-1] libvncserver security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"name": "openSUSE-SU-2020:0988",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"name": "openSUSE-SU-2020:1025",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"name": "openSUSE-SU-2020:1056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"name": "USN-4434-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"name": "[debian-lts-announce] 20200828 [SECURITY] [DLA 2347-1] libvncserver security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"name": "USN-4573-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14397",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13",
"refsource": "MISC",
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"name": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"refsource": "MISC",
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"name": "[debian-lts-announce] 20200630 [SECURITY] [DLA 2264-1] libvncserver security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"name": "openSUSE-SU-2020:0988",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"name": "openSUSE-SU-2020:1025",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"name": "openSUSE-SU-2020:1056",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"name": "USN-4434-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"name": "[debian-lts-announce] 20200828 [SECURITY] [DLA 2347-1] libvncserver security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"name": "USN-4573-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-14397",
"datePublished": "2020-06-17T15:13:30",
"dateReserved": "2020-06-17T00:00:00",
"dateUpdated": "2024-08-04T12:46:34.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-14397\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-06-17T16:15:11.773\",\"lastModified\":\"2024-11-21T05:03:10.483\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.\"},{\"lang\":\"es\",\"value\":\"Se detect\u00f3 un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/rfbregion.c presenta una desreferencia del puntero NULL\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.9.12\",\"matchCriteriaId\":\"A03A7282-D445-4E26-98A0-6A1597838D35\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"3A664216-EEA0-423F-8E11-59C746FDEEFE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9596C8CD-B03F-4E9D-82AB-0986FDD1B47C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"CD78291E-48D8-4718-AE14-BDF93BD557D7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BB898D3-07A3-42A1-8F1B-53C3B005982D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"AD1209DE-2724-493D-8276-1BE959BFE6BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A9143A6-A93A-45CA-8A1F-6EE30647B54A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"92F7FC17-F19F-4BD6-9704-49B67D22B532\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D34BD13-4E71-48A2-851D-AE7CE2A03C28\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"FE4A6F13-385B-4A13-B8D8-3BBC4E9D5B67\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E63E423-7450-4043-B33B-3FFF5BBE1CB2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0.0\",\"versionEndExcluding\":\"3.2.1.0\",\"matchCriteriaId\":\"71A51CA4-1A62-47BC-99A3-4DC9F3986FF5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD278558-AB0E-4FC1-9E5B-6B57D29CB86A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4434-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4573-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4434-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4573-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
gsd-2020-14397
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-14397",
"description": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"id": "GSD-2020-14397",
"references": [
"https://www.suse.com/security/cve/CVE-2020-14397.html",
"https://access.redhat.com/errata/RHSA-2021:1811",
"https://ubuntu.com/security/CVE-2020-14397",
"https://advisories.mageia.org/CVE-2020-14397.html",
"https://linux.oracle.com/cve/CVE-2020-14397.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-14397"
],
"details": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"id": "GSD-2020-14397",
"modified": "2023-12-13T01:21:59.861757Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14397",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13",
"refsource": "MISC",
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"name": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"refsource": "MISC",
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"name": "[debian-lts-announce] 20200630 [SECURITY] [DLA 2264-1] libvncserver security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"name": "openSUSE-SU-2020:0988",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"name": "openSUSE-SU-2020:1025",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"name": "openSUSE-SU-2020:1056",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"name": "USN-4434-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"name": "[debian-lts-announce] 20200828 [SECURITY] [DLA 2347-1] libvncserver security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"name": "USN-4573-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "0.9.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14397"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"name": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"name": "[debian-lts-announce] 20200630 [SECURITY] [DLA 2264-1] libvncserver security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"name": "openSUSE-SU-2020:0988",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"name": "openSUSE-SU-2020:1025",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"name": "openSUSE-SU-2020:1056",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"name": "USN-4434-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"name": "[debian-lts-announce] 20200828 [SECURITY] [DLA 2347-1] libvncserver security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"name": "USN-4573-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2022-03-10T15:14Z",
"publishedDate": "2020-06-17T16:15Z"
}
}
}
var-202006-1848
Vulnerability from variot
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference. LibVNCServer To NULL A vulnerability exists regarding pointer dereference.Service operation interruption (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libvncserver security update Advisory ID: RHSA-2021:1811-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1811 Issue date: 2021-05-18 CVE Names: CVE-2018-21247 CVE-2019-20839 CVE-2020-14397 CVE-2020-14405 CVE-2020-25708 ==================================================================== 1. Summary:
An update for libvncserver is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
- Description:
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.
Security Fix(es):
-
libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)
-
libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)
-
libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)
-
libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)
-
libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1849877 - CVE-2019-20839 libvncserver: buffer overflow in ConnectClientToUnixSock() 1849886 - CVE-2018-21247 libvncserver: uninitialized memory contents are vulnerable to Information Leak 1860325 - CVE-2020-14405 libvncserver: libvncclient/rfbproto.c does not limit TextChat size 1860344 - CVE-2020-14397 libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference 1896739 - CVE-2020-25708 libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS
- Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source: libvncserver-0.9.11-17.el8.src.rpm
aarch64: libvncserver-0.9.11-17.el8.aarch64.rpm libvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm libvncserver-debugsource-0.9.11-17.el8.aarch64.rpm
ppc64le: libvncserver-0.9.11-17.el8.ppc64le.rpm libvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm libvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm
s390x: libvncserver-0.9.11-17.el8.s390x.rpm libvncserver-debuginfo-0.9.11-17.el8.s390x.rpm libvncserver-debugsource-0.9.11-17.el8.s390x.rpm
x86_64: libvncserver-0.9.11-17.el8.i686.rpm libvncserver-0.9.11-17.el8.x86_64.rpm libvncserver-debuginfo-0.9.11-17.el8.i686.rpm libvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm libvncserver-debugsource-0.9.11-17.el8.i686.rpm libvncserver-debugsource-0.9.11-17.el8.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64: libvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm libvncserver-debugsource-0.9.11-17.el8.aarch64.rpm libvncserver-devel-0.9.11-17.el8.aarch64.rpm
ppc64le: libvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm libvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm libvncserver-devel-0.9.11-17.el8.ppc64le.rpm
s390x: libvncserver-debuginfo-0.9.11-17.el8.s390x.rpm libvncserver-debugsource-0.9.11-17.el8.s390x.rpm libvncserver-devel-0.9.11-17.el8.s390x.rpm
x86_64: libvncserver-debuginfo-0.9.11-17.el8.i686.rpm libvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm libvncserver-debugsource-0.9.11-17.el8.i686.rpm libvncserver-debugsource-0.9.11-17.el8.x86_64.rpm libvncserver-devel-0.9.11-17.el8.i686.rpm libvncserver-devel-0.9.11-17.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYKPzPNzjgjWX9erEAQgJcQ//eFCPv7OwkNtF1owJhqkboBZSSILHH2sX bXDy/9rdYjrY13E6kfMdjvXQyfSa8RM1lB+3LldAA1LokLqf6aTEHrBrjDadAKSW 2FfxerEbatQLlQubcxtrb5gn3ZUv+8gf/n3E8Fgjxm4EQkCZC3TF7Smmj3ofELtq 2aYKRKyOGrMR2JZuySPuB5fm9/8LcYlfn5atG4Yqc4QofgGe2YhORY6GuneUOSBr Li0LBXpBI7o3VY0dosXListDptm8UEZ8sx/hUEqR2YEBoQoGF3EZsuNsqzYkG99e i6LmBTh8zCgsnOHKrLVmG00YauAdpPrgmOq2cay7bw0jhAzp+huLtSCZ5yvEbh8p xOXM0YbocGwSoKdJ6RGaquYD4Vw/aKHIxp1L6BE3hMe2lIt6dObu+VxtgFmUVDFv iUvmv9J1Jr7lZAByA0r+1gnnfrXyUc+ln3jhuu0xZ3tQvGiEAKAsvDNB8/78TCT/ CmuU0jwvBxTqeISxAaWcCrl9LHg+gZv6wop8j8L/BDyEY4zQgAT11nRo0cXjFaE0 YgmFxA5kAEqDiNr2k/kq3w+sUH9pdEhiJQTqTt0uZvHesKXaIKTa7YKnvPgWbolM Nhw8esGKItirSh536uT/9/4DIQegxxM8sx5PhQCwL5pKldNGwiLyuFUF2ypRu9KT 8A9MNz92TFY=uZts -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2018-7225)
Pavel Cheremushkin discovered that an information disclosure vulnerability existed in Vino when sending a ServerCutText message. ========================================================================== Ubuntu Security Notice USN-4434-1 July 23, 2020
libvncserver vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in LibVNCServer.
Software Description: - libvncserver: vnc server library
Details:
Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitrary code. (CVE-2019-20839)
It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)
Christian Beier discovered that LibVNCServer incorrectly handled anonymous TLS connections. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14396)
It was discovered that LibVNCServer incorrectly handled region clipping. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14397)
It was discovered that LibVNCServer did not properly reset incorrectly terminated TCP connections. A remote attacker could possibly use this issue to cause an infinite loop, resulting in a denial of service. (CVE-2020-14398)
It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399, CVE-2020-14400)
It was discovered that LibVNCServer incorrectly handled screen scaling on the server side. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14401)
It was discovered that LibVNCServer incorrectly handled encodings. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)
It was discovered that LibVNCServer incorrectly handled TextChat messages. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14405)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.2 libvncserver1 0.9.12+dfsg-9ubuntu0.2
Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.3 libvncserver1 0.9.11+dfsg-1ubuntu1.3
Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.5 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.5
After a standard system update you need to restart LibVNCServer applications to make all the necessary changes.
References: https://usn.ubuntu.com/4434-1 CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397, CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401, CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405
Package Information: https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2 https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3 https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202006-1848",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "simatic itc2200",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "simatic itc1500 pro",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "simatic itc2200 pro",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "simatic itc1900 pro",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "simatic itc2200",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "18.04"
},
{
"model": "leap",
"scope": "eq",
"trust": 1.0,
"vendor": "opensuse",
"version": "15.2"
},
{
"model": "simatic itc1900",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "16.04"
},
{
"model": "simatic itc1500",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "14.04"
},
{
"model": "libvncserver",
"scope": "lte",
"trust": 1.0,
"vendor": "libvnc",
"version": "0.9.12"
},
{
"model": "simatic itc2200 pro",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "3.0.0.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "20.04"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "18.10"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "8.0"
},
{
"model": "simatic itc1900 pro",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "simatic itc1500 pro",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "simatic itc1900",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "simatic itc1500",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.2.1.0"
},
{
"model": "libvncserver",
"scope": "eq",
"trust": 0.8,
"vendor": "libvnc",
"version": "0.9.13"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:libvncserver_project:libvncserver",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "162682"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
}
],
"trust": 0.7
},
"cve": "CVE-2020-14397",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2020-14397",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-006694",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2020-14397",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-006694",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-14397",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-006694",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202006-1180",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference. LibVNCServer To NULL A vulnerability exists regarding pointer dereference.Service operation interruption (DoS) It may be put into a state. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: libvncserver security update\nAdvisory ID: RHSA-2021:1811-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2021:1811\nIssue date: 2021-05-18\nCVE Names: CVE-2018-21247 CVE-2019-20839 CVE-2020-14397\n CVE-2020-14405 CVE-2020-25708\n====================================================================\n1. Summary:\n\nAn update for libvncserver is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nLibVNCServer is a C library that enables you to implement VNC server\nfunctionality into own programs. \n\nSecurity Fix(es):\n\n* libvncserver: uninitialized memory contents are vulnerable to Information\nLeak (CVE-2018-21247)\n\n* libvncserver: buffer overflow in ConnectClientToUnixSock()\n(CVE-2019-20839)\n\n* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference\n(CVE-2020-14397)\n\n* libvncserver: libvncclient/rfbproto.c does not limit TextChat size\n(CVE-2020-14405)\n\n* libvncserver: libvncserver/rfbserver.c has a divide by zero which could\nresult in DoS (CVE-2020-25708)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.4 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1849877 - CVE-2019-20839 libvncserver: buffer overflow in ConnectClientToUnixSock()\n1849886 - CVE-2018-21247 libvncserver: uninitialized memory contents are vulnerable to Information Leak\n1860325 - CVE-2020-14405 libvncserver: libvncclient/rfbproto.c does not limit TextChat size\n1860344 - CVE-2020-14397 libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference\n1896739 - CVE-2020-25708 libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\nSource:\nlibvncserver-0.9.11-17.el8.src.rpm\n\naarch64:\nlibvncserver-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.aarch64.rpm\n\nppc64le:\nlibvncserver-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm\n\ns390x:\nlibvncserver-0.9.11-17.el8.s390x.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.s390x.rpm\nlibvncserver-debugsource-0.9.11-17.el8.s390x.rpm\n\nx86_64:\nlibvncserver-0.9.11-17.el8.i686.rpm\nlibvncserver-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.i686.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.i686.rpm\nlibvncserver-debugsource-0.9.11-17.el8.x86_64.rpm\n\nRed Hat CodeReady Linux Builder (v. 8):\n\naarch64:\nlibvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.aarch64.rpm\nlibvncserver-devel-0.9.11-17.el8.aarch64.rpm\n\nppc64le:\nlibvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-devel-0.9.11-17.el8.ppc64le.rpm\n\ns390x:\nlibvncserver-debuginfo-0.9.11-17.el8.s390x.rpm\nlibvncserver-debugsource-0.9.11-17.el8.s390x.rpm\nlibvncserver-devel-0.9.11-17.el8.s390x.rpm\n\nx86_64:\nlibvncserver-debuginfo-0.9.11-17.el8.i686.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.i686.rpm\nlibvncserver-debugsource-0.9.11-17.el8.x86_64.rpm\nlibvncserver-devel-0.9.11-17.el8.i686.rpm\nlibvncserver-devel-0.9.11-17.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYKPzPNzjgjWX9erEAQgJcQ//eFCPv7OwkNtF1owJhqkboBZSSILHH2sX\nbXDy/9rdYjrY13E6kfMdjvXQyfSa8RM1lB+3LldAA1LokLqf6aTEHrBrjDadAKSW\n2FfxerEbatQLlQubcxtrb5gn3ZUv+8gf/n3E8Fgjxm4EQkCZC3TF7Smmj3ofELtq\n2aYKRKyOGrMR2JZuySPuB5fm9/8LcYlfn5atG4Yqc4QofgGe2YhORY6GuneUOSBr\nLi0LBXpBI7o3VY0dosXListDptm8UEZ8sx/hUEqR2YEBoQoGF3EZsuNsqzYkG99e\ni6LmBTh8zCgsnOHKrLVmG00YauAdpPrgmOq2cay7bw0jhAzp+huLtSCZ5yvEbh8p\nxOXM0YbocGwSoKdJ6RGaquYD4Vw/aKHIxp1L6BE3hMe2lIt6dObu+VxtgFmUVDFv\niUvmv9J1Jr7lZAByA0r+1gnnfrXyUc+ln3jhuu0xZ3tQvGiEAKAsvDNB8/78TCT/\nCmuU0jwvBxTqeISxAaWcCrl9LHg+gZv6wop8j8L/BDyEY4zQgAT11nRo0cXjFaE0\nYgmFxA5kAEqDiNr2k/kq3w+sUH9pdEhiJQTqTt0uZvHesKXaIKTa7YKnvPgWbolM\nNhw8esGKItirSh536uT/9/4DIQegxxM8sx5PhQCwL5pKldNGwiLyuFUF2ypRu9KT\n8A9MNz92TFY=uZts\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. \n(CVE-2018-7225)\n\nPavel Cheremushkin discovered that an information disclosure vulnerability\nexisted in Vino when sending a ServerCutText message. ==========================================================================\nUbuntu Security Notice USN-4434-1\nJuly 23, 2020\n\nlibvncserver vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in LibVNCServer. \n\nSoftware Description:\n- libvncserver: vnc server library\n\nDetails:\n\nRamin Farajpour Cami discovered that LibVNCServer incorrectly handled\ncertain malformed unix socket names. A remote attacker could exploit this\nwith a crafted socket name, leading to a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-20839)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)\n\nChristian Beier discovered that LibVNCServer incorrectly handled anonymous\nTLS connections. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2020-14396)\n\nIt was discovered that LibVNCServer incorrectly handled region clipping. A\nremote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14397)\n\nIt was discovered that LibVNCServer did not properly reset incorrectly\nterminated TCP connections. A remote attacker could possibly use this\nissue to cause an infinite loop, resulting in a denial of service. \n(CVE-2020-14398)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399,\nCVE-2020-14400)\n\nIt was discovered that LibVNCServer incorrectly handled screen scaling on\nthe server side. A remote attacker could use this issue to cause\nLibVNCServer to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2020-14401)\n\nIt was discovered that LibVNCServer incorrectly handled encodings. A\nremote attacker could use this issue to cause LibVNCServer to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)\n\nIt was discovered that LibVNCServer incorrectly handled TextChat messages. \nA remote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14405)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n libvncclient1 0.9.12+dfsg-9ubuntu0.2\n libvncserver1 0.9.12+dfsg-9ubuntu0.2\n\nUbuntu 18.04 LTS:\n libvncclient1 0.9.11+dfsg-1ubuntu1.3\n libvncserver1 0.9.11+dfsg-1ubuntu1.3\n\nUbuntu 16.04 LTS:\n libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.5\n libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.5\n\nAfter a standard system update you need to restart LibVNCServer\napplications to make all the necessary changes. \n\nReferences:\n https://usn.ubuntu.com/4434-1\n CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397,\n CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401,\n CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3\n https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-14397"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "PACKETSTORM",
"id": "162682"
},
{
"db": "PACKETSTORM",
"id": "159499"
},
{
"db": "PACKETSTORM",
"id": "158543"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-14397",
"trust": 2.7
},
{
"db": "SIEMENS",
"id": "SSA-390195",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2020-006694",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "162682",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "159499",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "158543",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.1705",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2248",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2535",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2727",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2469",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.3465",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2972",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021052205",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021121649",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "48876",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "PACKETSTORM",
"id": "162682"
},
{
"db": "PACKETSTORM",
"id": "159499"
},
{
"db": "PACKETSTORM",
"id": "158543"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"id": "VAR-202006-1848",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.33603895
},
"last_update_date": "2024-11-23T19:56:40.066000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "libvncserver: add missing NULL pointer checks",
"trust": 0.8,
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"title": "Comparing changes",
"trust": 0.8,
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"title": "LibVNCServer Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122071"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-476",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14397"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"trust": 1.6,
"url": "https://github.com/libvnc/libvncserver/compare/libvncserver-0.9.12...libvncserver-0.9.13"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"trust": 1.6,
"url": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"trust": 1.6,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"trust": 1.6,
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"trust": 1.6,
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14397"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/48876"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/libvncserver-multiple-vulnerabilities-32651"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021052205"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.1705"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/162682/red-hat-security-advisory-2021-1811-01.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/158543/ubuntu-security-notice-usn-4434-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2972/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2469/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2248/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2535/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2727/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3465/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021121649"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/159499/ubuntu-security-notice-usn-4573-1.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20839"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14405"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14402"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-14397"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-25708"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-21247"
},
{
"trust": 0.1,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:1811"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-21247"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-14405"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-25708"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-20839"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/vino/3.8.1-0ubuntu9.3"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-15681"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/vino/3.22.0-5ubuntu2.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14403"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/vino/3.22.0-3ubuntu1.1"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/4573-1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-6053"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-7225"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14400"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/4434-1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14398"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14401"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14396"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20840"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "PACKETSTORM",
"id": "162682"
},
{
"db": "PACKETSTORM",
"id": "159499"
},
{
"db": "PACKETSTORM",
"id": "158543"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"db": "PACKETSTORM",
"id": "162682"
},
{
"db": "PACKETSTORM",
"id": "159499"
},
{
"db": "PACKETSTORM",
"id": "158543"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-07-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"date": "2021-05-19T14:14:14",
"db": "PACKETSTORM",
"id": "162682"
},
{
"date": "2020-10-07T16:06:41",
"db": "PACKETSTORM",
"id": "159499"
},
{
"date": "2020-07-24T14:28:24",
"db": "PACKETSTORM",
"id": "158543"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2020-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"date": "2020-06-17T16:15:11.773000",
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-07-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-006694"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202006-1180"
},
{
"date": "2024-11-21T05:03:10.483000",
"db": "NVD",
"id": "CVE-2020-14397"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "159499"
},
{
"db": "PACKETSTORM",
"id": "158543"
},
{
"db": "CNNVD",
"id": "CNNVD-202006-1180"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LibVNCServer In NULL Pointer dereference vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-006694"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
}
],
"trust": 0.6
}
}
suse-su-2020:14424-1
Vulnerability from csaf_suse
Published
2020-07-17 12:21
Modified
2020-07-17 12:21
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
- added patches
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
+ LibVNCServer-CVE-2020-14398.patch
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
+ LibVNCServer-CVE-2020-14397.patch
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
+ LibVNCServer-CVE-2020-14399.patch
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
+ LibVNCServer-CVE-2020-14400.patch
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
+ LibVNCServer-CVE-2020-14401.patch
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
+ LibVNCServer-CVE-2020-14402,14403,14404.patch
Patchnames
sleposp3-LibVNCServer-14424,slessp4-LibVNCServer-14424
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleposp3-LibVNCServer-14424,slessp4-LibVNCServer-14424",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_14424-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:14424-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-202014424-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:14424-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-July/007150.html"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-07-17T12:21:12Z",
"generator": {
"date": "2020-07-17T12:21:12Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:14424-1",
"initial_release_date": "2020-07-17T12:21:12Z",
"revision_history": [
{
"date": "2020-07-17T12:21:12Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-0.9.1-160.19.1.i586",
"product": {
"name": "LibVNCServer-0.9.1-160.19.1.i586",
"product_id": "LibVNCServer-0.9.1-160.19.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-0.9.1-160.19.1.ppc64",
"product": {
"name": "LibVNCServer-0.9.1-160.19.1.ppc64",
"product_id": "LibVNCServer-0.9.1-160.19.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-0.9.1-160.19.1.s390x",
"product": {
"name": "LibVNCServer-0.9.1-160.19.1.s390x",
"product_id": "LibVNCServer-0.9.1-160.19.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-0.9.1-160.19.1.x86_64",
"product": {
"name": "LibVNCServer-0.9.1-160.19.1.x86_64",
"product_id": "LibVNCServer-0.9.1-160.19.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-pos:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-0.9.1-160.19.1.i586 as component of SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586"
},
"product_reference": "LibVNCServer-0.9.1-160.19.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-0.9.1-160.19.1.i586 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586"
},
"product_reference": "LibVNCServer-0.9.1-160.19.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-0.9.1-160.19.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64"
},
"product_reference": "LibVNCServer-0.9.1-160.19.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-0.9.1-160.19.1.s390x as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x"
},
"product_reference": "LibVNCServer-0.9.1-160.19.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-0.9.1-160.19.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
},
"product_reference": "LibVNCServer-0.9.1-160.19.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:LibVNCServer-0.9.1-160.19.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-17T12:21:12Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
}
]
}
suse-su-2020:1922-1
Vulnerability from csaf_suse
Published
2020-07-15 09:31
Modified
2020-07-15 09:31
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
- added patches
fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
+ LibVNCServer-CVE-2018-21247.patch
fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
+ LibVNCServer-CVE-2019-20839.patch
fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
+ LibVNCServer-CVE-2019-20840.patch
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
+ LibVNCServer-CVE-2020-14398.patch
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
+ LibVNCServer-CVE-2020-14397.patch
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
+ LibVNCServer-CVE-2020-14399.patch
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
+ LibVNCServer-CVE-2020-14400.patch
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
+ LibVNCServer-CVE-2020-14401.patch
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
+ LibVNCServer-CVE-2020-14402,14403,14404.patch
fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
Patchnames
SUSE-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP1-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2020-1922,SUSE-SLE-Product-WE-15-SP1-2020-1922,SUSE-SLE-Product-WE-15-SP2-2020-1922
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP1-2020-1922,SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2020-1922,SUSE-SLE-Product-WE-15-SP1-2020-1922,SUSE-SLE-Product-WE-15-SP2-2020-1922",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1922-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:1922-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-20201922-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:1922-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-July/007136.html"
},
{
"category": "self",
"summary": "SUSE Bug 1173477",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173874",
"url": "https://bugzilla.suse.com/1173874"
},
{
"category": "self",
"summary": "SUSE Bug 1173875",
"url": "https://bugzilla.suse.com/1173875"
},
{
"category": "self",
"summary": "SUSE Bug 1173876",
"url": "https://bugzilla.suse.com/1173876"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-07-15T09:31:09Z",
"generator": {
"date": "2020-07-15T09:31:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:1922-1",
"initial_release_date": "2020-07-15T09:31:09Z",
"revision_history": [
{
"date": "2020-07-15T09:31:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-4.22.1.aarch64",
"product": {
"name": "LibVNCServer-devel-0.9.10-4.22.1.aarch64",
"product_id": "LibVNCServer-devel-0.9.10-4.22.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-4.22.1.aarch64",
"product": {
"name": "libvncclient0-0.9.10-4.22.1.aarch64",
"product_id": "libvncclient0-0.9.10-4.22.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-4.22.1.aarch64",
"product": {
"name": "libvncserver0-0.9.10-4.22.1.aarch64",
"product_id": "libvncserver0-0.9.10-4.22.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-4.22.1.i586",
"product": {
"name": "LibVNCServer-devel-0.9.10-4.22.1.i586",
"product_id": "LibVNCServer-devel-0.9.10-4.22.1.i586"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-4.22.1.i586",
"product": {
"name": "libvncclient0-0.9.10-4.22.1.i586",
"product_id": "libvncclient0-0.9.10-4.22.1.i586"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-4.22.1.i586",
"product": {
"name": "libvncserver0-0.9.10-4.22.1.i586",
"product_id": "libvncserver0-0.9.10-4.22.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le",
"product": {
"name": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le",
"product_id": "LibVNCServer-devel-0.9.10-4.22.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-4.22.1.ppc64le",
"product": {
"name": "libvncclient0-0.9.10-4.22.1.ppc64le",
"product_id": "libvncclient0-0.9.10-4.22.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-4.22.1.ppc64le",
"product": {
"name": "libvncserver0-0.9.10-4.22.1.ppc64le",
"product_id": "libvncserver0-0.9.10-4.22.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-4.22.1.s390x",
"product": {
"name": "LibVNCServer-devel-0.9.10-4.22.1.s390x",
"product_id": "LibVNCServer-devel-0.9.10-4.22.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-4.22.1.s390x",
"product": {
"name": "libvncclient0-0.9.10-4.22.1.s390x",
"product_id": "libvncclient0-0.9.10-4.22.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-4.22.1.s390x",
"product": {
"name": "libvncserver0-0.9.10-4.22.1.s390x",
"product_id": "libvncserver0-0.9.10-4.22.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-4.22.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.10-4.22.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.10-4.22.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-4.22.1.x86_64",
"product": {
"name": "libvncclient0-0.9.10-4.22.1.x86_64",
"product_id": "libvncclient0-0.9.10-4.22.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-4.22.1.x86_64",
"product": {
"name": "libvncserver0-0.9.10-4.22.1.x86_64",
"product_id": "libvncserver0-0.9.10-4.22.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Workstation Extension 15 SP1",
"product": {
"name": "SUSE Linux Enterprise Workstation Extension 15 SP1",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-we:15:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Workstation Extension 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Workstation Extension 15 SP2",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-we:15:sp2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP1",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP2",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP1",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64"
},
"product_reference": "libvncclient0-0.9.10-4.22.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP2",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64"
},
"product_reference": "libvncclient0-0.9.10-4.22.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-4.22.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP2",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
},
"product_reference": "libvncserver0-0.9.10-4.22.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP1:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP1:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncclient0-0.9.10-4.22.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP2:libvncserver0-0.9.10-4.22.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-15T09:31:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
}
]
}
suse-su-2020:2167-1
Vulnerability from csaf_suse
Published
2020-08-07 12:54
Modified
2020-08-07 12:54
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings.
fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings.
fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
Patchnames
HPE-Helion-OpenStack-8-2020-2167,SUSE-2020-2167,SUSE-OpenStack-Cloud-7-2020-2167,SUSE-OpenStack-Cloud-8-2020-2167,SUSE-OpenStack-Cloud-9-2020-2167,SUSE-OpenStack-Cloud-Crowbar-8-2020-2167,SUSE-OpenStack-Cloud-Crowbar-9-2020-2167,SUSE-SLE-SAP-12-SP2-2020-2167,SUSE-SLE-SAP-12-SP3-2020-2167,SUSE-SLE-SAP-12-SP4-2020-2167,SUSE-SLE-SDK-12-SP5-2020-2167,SUSE-SLE-SERVER-12-SP2-2020-2167,SUSE-SLE-SERVER-12-SP2-BCL-2020-2167,SUSE-SLE-SERVER-12-SP3-2020-2167,SUSE-SLE-SERVER-12-SP3-BCL-2020-2167,SUSE-SLE-SERVER-12-SP4-LTSS-2020-2167,SUSE-SLE-SERVER-12-SP5-2020-2167,SUSE-Storage-5-2020-2167
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings.\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "HPE-Helion-OpenStack-8-2020-2167,SUSE-2020-2167,SUSE-OpenStack-Cloud-7-2020-2167,SUSE-OpenStack-Cloud-8-2020-2167,SUSE-OpenStack-Cloud-9-2020-2167,SUSE-OpenStack-Cloud-Crowbar-8-2020-2167,SUSE-OpenStack-Cloud-Crowbar-9-2020-2167,SUSE-SLE-SAP-12-SP2-2020-2167,SUSE-SLE-SAP-12-SP3-2020-2167,SUSE-SLE-SAP-12-SP4-2020-2167,SUSE-SLE-SDK-12-SP5-2020-2167,SUSE-SLE-SERVER-12-SP2-2020-2167,SUSE-SLE-SERVER-12-SP2-BCL-2020-2167,SUSE-SLE-SERVER-12-SP3-2020-2167,SUSE-SLE-SERVER-12-SP3-BCL-2020-2167,SUSE-SLE-SERVER-12-SP4-LTSS-2020-2167,SUSE-SLE-SERVER-12-SP5-2020-2167,SUSE-Storage-5-2020-2167",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_2167-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2020:2167-1",
"url": "https://www.suse.com/support/update/announcement/2020/suse-su-20202167-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2020:2167-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-August/007241.html"
},
{
"category": "self",
"summary": "SUSE Bug 1173477",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173874",
"url": "https://bugzilla.suse.com/1173874"
},
{
"category": "self",
"summary": "SUSE Bug 1173875",
"url": "https://bugzilla.suse.com/1173875"
},
{
"category": "self",
"summary": "SUSE Bug 1173876",
"url": "https://bugzilla.suse.com/1173876"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14403 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14403/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14404 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14404/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-08-07T12:54:44Z",
"generator": {
"date": "2020-08-07T12:54:44Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2020:2167-1",
"initial_release_date": "2020-08-07T12:54:44Z",
"revision_history": [
{
"date": "2020-08-07T12:54:44Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.aarch64",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64",
"product_id": "libvncclient0-0.9.9-17.31.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.aarch64",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64",
"product_id": "libvncserver0-0.9.9-17.31.1.aarch64"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.aarch64",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.aarch64",
"product_id": "linuxvnc-0.9.9-17.31.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.i586",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.i586",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.i586"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.i586",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.i586",
"product_id": "libvncclient0-0.9.9-17.31.1.i586"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.i586",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.i586",
"product_id": "libvncserver0-0.9.9-17.31.1.i586"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.i586",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.i586",
"product_id": "linuxvnc-0.9.9-17.31.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.ppc64le",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le",
"product_id": "libvncclient0-0.9.9-17.31.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.ppc64le",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le",
"product_id": "libvncserver0-0.9.9-17.31.1.ppc64le"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.ppc64le",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.ppc64le",
"product_id": "linuxvnc-0.9.9-17.31.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.s390",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.s390",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.s390"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.s390",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.s390",
"product_id": "libvncclient0-0.9.9-17.31.1.s390"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.s390",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.s390",
"product_id": "libvncserver0-0.9.9-17.31.1.s390"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.s390",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.s390",
"product_id": "linuxvnc-0.9.9-17.31.1.s390"
}
}
],
"category": "architecture",
"name": "s390"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.s390x",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.s390x",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.s390x",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.s390x",
"product_id": "libvncclient0-0.9.9-17.31.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.s390x",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.s390x",
"product_id": "libvncserver0-0.9.9-17.31.1.s390x"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.s390x",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.s390x",
"product_id": "linuxvnc-0.9.9-17.31.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncclient0-0.9.9-17.31.1.x86_64",
"product": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64",
"product_id": "libvncclient0-0.9.9-17.31.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.9-17.31.1.x86_64",
"product": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64",
"product_id": "libvncserver0-0.9.9-17.31.1.x86_64"
}
},
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.9-17.31.1.x86_64"
}
},
{
"category": "product_version",
"name": "linuxvnc-0.9.9-17.31.1.x86_64",
"product": {
"name": "linuxvnc-0.9.9-17.31.1.x86_64",
"product_id": "linuxvnc-0.9.9-17.31.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "HPE Helion OpenStack 8",
"product": {
"name": "HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:hpe-helion-openstack:8"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 7",
"product": {
"name": "SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:7"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 8",
"product": {
"name": "SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:8"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 9",
"product": {
"name": "SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:9"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud Crowbar 8",
"product": {
"name": "SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud Crowbar 9",
"product": {
"name": "SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:9"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-sdk:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP3-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 5",
"product": {
"name": "SUSE Enterprise Storage 5",
"product_id": "SUSE Enterprise Storage 5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of HPE Helion OpenStack 8",
"product_id": "HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "HPE Helion OpenStack 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 8",
"product_id": "SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud 9",
"product_id": "SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 8",
"product_id": "SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE OpenStack Cloud Crowbar 9",
"product_id": "SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64"
},
"product_reference": "LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le"
},
"product_reference": "LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x"
},
"product_reference": "LibVNCServer-devel-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP3-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
"product_id": "SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.aarch64 as component of SUSE Enterprise Storage 5",
"product_id": "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.9-17.31.1.x86_64 as component of SUSE Enterprise Storage 5",
"product_id": "SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncclient0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.aarch64 as component of SUSE Enterprise Storage 5",
"product_id": "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.9-17.31.1.x86_64 as component of SUSE Enterprise Storage 5",
"product_id": "SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64"
},
"product_reference": "libvncserver0-0.9.9-17.31.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
},
{
"cve": "CVE-2020-14403",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14403"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14403",
"url": "https://www.suse.com/security/cve/CVE-2020-14403"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14403",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14403"
},
{
"cve": "CVE-2020-14404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14404"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14404",
"url": "https://www.suse.com/security/cve/CVE-2020-14404"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14404",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"HPE Helion OpenStack 8:libvncclient0-0.9.9-17.31.1.x86_64",
"HPE Helion OpenStack 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Enterprise Storage 5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-BCL:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP3-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP4-LTSS:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.aarch64",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP5:LibVNCServer-devel-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.s390x",
"SUSE OpenStack Cloud 7:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud 9:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 8:libvncserver0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncclient0-0.9.9-17.31.1.x86_64",
"SUSE OpenStack Cloud Crowbar 9:libvncserver0-0.9.9-17.31.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-08-07T12:54:44Z",
"details": "moderate"
}
],
"title": "CVE-2020-14404"
}
]
}
opensuse-su-2020:0988-1
Vulnerability from csaf_opensuse
Published
2020-07-18 12:27
Modified
2020-07-18 12:27
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
- added patches
fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
+ LibVNCServer-CVE-2018-21247.patch
fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
+ LibVNCServer-CVE-2019-20839.patch
fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
+ LibVNCServer-CVE-2019-20840.patch
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
+ LibVNCServer-CVE-2020-14398.patch
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
+ LibVNCServer-CVE-2020-14397.patch
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
+ LibVNCServer-CVE-2020-14399.patch
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
+ LibVNCServer-CVE-2020-14400.patch
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
+ LibVNCServer-CVE-2020-14401.patch
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
+ LibVNCServer-CVE-2020-14402,14403,14404.patch
fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2020-988
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-988",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0988-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0988-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RH2MWYCQ3Y7WV6I2GEEBEI2J57NGY36J/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0988-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RH2MWYCQ3Y7WV6I2GEEBEI2J57NGY36J/"
},
{
"category": "self",
"summary": "SUSE Bug 1173477",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173874",
"url": "https://bugzilla.suse.com/1173874"
},
{
"category": "self",
"summary": "SUSE Bug 1173875",
"url": "https://bugzilla.suse.com/1173875"
},
{
"category": "self",
"summary": "SUSE Bug 1173876",
"url": "https://bugzilla.suse.com/1173876"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-07-18T12:27:09Z",
"generator": {
"date": "2020-07-18T12:27:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0988-1",
"initial_release_date": "2020-07-18T12:27:09Z",
"revision_history": [
{
"date": "2020-07-18T12:27:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"product_id": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp151.7.9.1.i586",
"product": {
"name": "libvncclient0-0.9.10-lp151.7.9.1.i586",
"product_id": "libvncclient0-0.9.10-lp151.7.9.1.i586"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp151.7.9.1.i586",
"product": {
"name": "libvncserver0-0.9.10-lp151.7.9.1.i586",
"product_id": "libvncserver0-0.9.10-lp151.7.9.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"product": {
"name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"product_id": "libvncclient0-0.9.10-lp151.7.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64",
"product": {
"name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64",
"product_id": "libvncserver0-0.9.10-lp151.7.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586"
},
"product_reference": "libvncclient0-0.9.10-lp151.7.9.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64"
},
"product_reference": "libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp151.7.9.1.i586 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586"
},
"product_reference": "libvncserver0-0.9.10-lp151.7.9.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp151.7.9.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
},
"product_reference": "libvncserver0-0.9.10-lp151.7.9.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:LibVNCServer-devel-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncclient0-0.9.10-lp151.7.9.1.x86_64",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.i586",
"openSUSE Leap 15.1:libvncserver0-0.9.10-lp151.7.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-18T12:27:09Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
}
]
}
opensuse-su-2024:10598-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
LibVNCServer-devel-0.9.13-3.1 on GA media
Notes
Title of the patch
LibVNCServer-devel-0.9.13-3.1 on GA media
Description of the patch
These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10598
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "LibVNCServer-devel-0.9.13-3.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10598",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10598-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2006-2450 page",
"url": "https://www.suse.com/security/cve/CVE-2006-2450/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-15126 page",
"url": "https://www.suse.com/security/cve/CVE-2018-15126/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-15127 page",
"url": "https://www.suse.com/security/cve/CVE-2018-15127/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20019 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20019/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20020 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20020/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20021 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20022 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20023 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20024 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20024/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20748 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20748/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20749 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20749/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20750 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20750/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-6307 page",
"url": "https://www.suse.com/security/cve/CVE-2018-6307/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7225 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7225/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-15681 page",
"url": "https://www.suse.com/security/cve/CVE-2019-15681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-15690 page",
"url": "https://www.suse.com/security/cve/CVE-2019-15690/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20788 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20788/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14403 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14403/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14404 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14404/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25708 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25708/"
}
],
"title": "LibVNCServer-devel-0.9.13-3.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10598-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.13-3.1.aarch64",
"product": {
"name": "LibVNCServer-devel-0.9.13-3.1.aarch64",
"product_id": "LibVNCServer-devel-0.9.13-3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.13-3.1.aarch64",
"product": {
"name": "libvncclient1-0.9.13-3.1.aarch64",
"product_id": "libvncclient1-0.9.13-3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.13-3.1.aarch64",
"product": {
"name": "libvncserver1-0.9.13-3.1.aarch64",
"product_id": "libvncserver1-0.9.13-3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.13-3.1.ppc64le",
"product": {
"name": "LibVNCServer-devel-0.9.13-3.1.ppc64le",
"product_id": "LibVNCServer-devel-0.9.13-3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.13-3.1.ppc64le",
"product": {
"name": "libvncclient1-0.9.13-3.1.ppc64le",
"product_id": "libvncclient1-0.9.13-3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.13-3.1.ppc64le",
"product": {
"name": "libvncserver1-0.9.13-3.1.ppc64le",
"product_id": "libvncserver1-0.9.13-3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.13-3.1.s390x",
"product": {
"name": "LibVNCServer-devel-0.9.13-3.1.s390x",
"product_id": "LibVNCServer-devel-0.9.13-3.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.13-3.1.s390x",
"product": {
"name": "libvncclient1-0.9.13-3.1.s390x",
"product_id": "libvncclient1-0.9.13-3.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.13-3.1.s390x",
"product": {
"name": "libvncserver1-0.9.13-3.1.s390x",
"product_id": "libvncserver1-0.9.13-3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.13-3.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.13-3.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.13-3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.13-3.1.x86_64",
"product": {
"name": "libvncclient1-0.9.13-3.1.x86_64",
"product_id": "libvncclient1-0.9.13-3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.13-3.1.x86_64",
"product": {
"name": "libvncserver1-0.9.13-3.1.x86_64",
"product_id": "libvncserver1-0.9.13-3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64"
},
"product_reference": "LibVNCServer-devel-0.9.13-3.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le"
},
"product_reference": "LibVNCServer-devel-0.9.13-3.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.13-3.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x"
},
"product_reference": "LibVNCServer-devel-0.9.13-3.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.13-3.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64"
},
"product_reference": "libvncclient1-0.9.13-3.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le"
},
"product_reference": "libvncclient1-0.9.13-3.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.13-3.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x"
},
"product_reference": "libvncclient1-0.9.13-3.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64"
},
"product_reference": "libvncclient1-0.9.13-3.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.13-3.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64"
},
"product_reference": "libvncserver1-0.9.13-3.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.13-3.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le"
},
"product_reference": "libvncserver1-0.9.13-3.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.13-3.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x"
},
"product_reference": "libvncserver1-0.9.13-3.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.13-3.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
},
"product_reference": "libvncserver1-0.9.13-3.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2006-2450",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2006-2450"
}
],
"notes": [
{
"category": "general",
"text": "auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as \"Type 1 - None\", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2006-2450",
"url": "https://www.suse.com/security/cve/CVE-2006-2450"
},
{
"category": "external",
"summary": "SUSE Bug 184418 for CVE-2006-2450",
"url": "https://bugzilla.suse.com/184418"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2006-2450"
},
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-15126",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-15126"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-15126",
"url": "https://www.suse.com/security/cve/CVE-2018-15126"
},
{
"category": "external",
"summary": "SUSE Bug 1120114 for CVE-2018-15126",
"url": "https://bugzilla.suse.com/1120114"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-15126"
},
{
"cve": "CVE-2018-15127",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-15127"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-15127",
"url": "https://www.suse.com/security/cve/CVE-2018-15127"
},
{
"category": "external",
"summary": "SUSE Bug 1120117 for CVE-2018-15127",
"url": "https://bugzilla.suse.com/1120117"
},
{
"category": "external",
"summary": "SUSE Bug 1123828 for CVE-2018-15127",
"url": "https://bugzilla.suse.com/1123828"
},
{
"category": "external",
"summary": "SUSE Bug 1123832 for CVE-2018-15127",
"url": "https://bugzilla.suse.com/1123832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-15127"
},
{
"cve": "CVE-2018-20019",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20019"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20019",
"url": "https://www.suse.com/security/cve/CVE-2018-20019"
},
{
"category": "external",
"summary": "SUSE Bug 1120118 for CVE-2018-20019",
"url": "https://bugzilla.suse.com/1120118"
},
{
"category": "external",
"summary": "SUSE Bug 1123823 for CVE-2018-20019",
"url": "https://bugzilla.suse.com/1123823"
},
{
"category": "external",
"summary": "SUSE Bug 1155442 for CVE-2018-20019",
"url": "https://bugzilla.suse.com/1155442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-20019"
},
{
"cve": "CVE-2018-20020",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20020"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20020",
"url": "https://www.suse.com/security/cve/CVE-2018-20020"
},
{
"category": "external",
"summary": "SUSE Bug 1120116 for CVE-2018-20020",
"url": "https://bugzilla.suse.com/1120116"
},
{
"category": "external",
"summary": "SUSE Bug 1155472 for CVE-2018-20020",
"url": "https://bugzilla.suse.com/1155472"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-20020"
},
{
"cve": "CVE-2018-20021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20021"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20021",
"url": "https://www.suse.com/security/cve/CVE-2018-20021"
},
{
"category": "external",
"summary": "SUSE Bug 1120122 for CVE-2018-20021",
"url": "https://bugzilla.suse.com/1120122"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20021"
},
{
"cve": "CVE-2018-20022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20022"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20022",
"url": "https://www.suse.com/security/cve/CVE-2018-20022"
},
{
"category": "external",
"summary": "SUSE Bug 1120120 for CVE-2018-20022",
"url": "https://bugzilla.suse.com/1120120"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20022"
},
{
"cve": "CVE-2018-20023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20023"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20023",
"url": "https://www.suse.com/security/cve/CVE-2018-20023"
},
{
"category": "external",
"summary": "SUSE Bug 1120119 for CVE-2018-20023",
"url": "https://bugzilla.suse.com/1120119"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20023"
},
{
"cve": "CVE-2018-20024",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20024"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that can result DoS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20024",
"url": "https://www.suse.com/security/cve/CVE-2018-20024"
},
{
"category": "external",
"summary": "SUSE Bug 1120121 for CVE-2018-20024",
"url": "https://bugzilla.suse.com/1120121"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20024"
},
{
"cve": "CVE-2018-20748",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20748"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20748",
"url": "https://www.suse.com/security/cve/CVE-2018-20748"
},
{
"category": "external",
"summary": "SUSE Bug 1120118 for CVE-2018-20748",
"url": "https://bugzilla.suse.com/1120118"
},
{
"category": "external",
"summary": "SUSE Bug 1123823 for CVE-2018-20748",
"url": "https://bugzilla.suse.com/1123823"
},
{
"category": "external",
"summary": "SUSE Bug 1155442 for CVE-2018-20748",
"url": "https://bugzilla.suse.com/1155442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-20748"
},
{
"cve": "CVE-2018-20749",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20749"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20749",
"url": "https://www.suse.com/security/cve/CVE-2018-20749"
},
{
"category": "external",
"summary": "SUSE Bug 1120117 for CVE-2018-20749",
"url": "https://bugzilla.suse.com/1120117"
},
{
"category": "external",
"summary": "SUSE Bug 1123828 for CVE-2018-20749",
"url": "https://bugzilla.suse.com/1123828"
},
{
"category": "external",
"summary": "SUSE Bug 1123832 for CVE-2018-20749",
"url": "https://bugzilla.suse.com/1123832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-20749"
},
{
"cve": "CVE-2018-20750",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20750"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20750",
"url": "https://www.suse.com/security/cve/CVE-2018-20750"
},
{
"category": "external",
"summary": "SUSE Bug 1120117 for CVE-2018-20750",
"url": "https://bugzilla.suse.com/1120117"
},
{
"category": "external",
"summary": "SUSE Bug 1123832 for CVE-2018-20750",
"url": "https://bugzilla.suse.com/1123832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-20750"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2018-6307",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-6307"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-6307",
"url": "https://www.suse.com/security/cve/CVE-2018-6307"
},
{
"category": "external",
"summary": "SUSE Bug 1120115 for CVE-2018-6307",
"url": "https://bugzilla.suse.com/1120115"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-6307"
},
{
"cve": "CVE-2018-7225",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7225"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7225",
"url": "https://www.suse.com/security/cve/CVE-2018-7225"
},
{
"category": "external",
"summary": "SUSE Bug 1081493 for CVE-2018-7225",
"url": "https://bugzilla.suse.com/1081493"
},
{
"category": "external",
"summary": "SUSE Bug 1090647 for CVE-2018-7225",
"url": "https://bugzilla.suse.com/1090647"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-7225"
},
{
"cve": "CVE-2019-15681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-15681"
}
],
"notes": [
{
"category": "general",
"text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-15681",
"url": "https://www.suse.com/security/cve/CVE-2019-15681"
},
{
"category": "external",
"summary": "SUSE Bug 1155419 for CVE-2019-15681",
"url": "https://bugzilla.suse.com/1155419"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-15681"
},
{
"cve": "CVE-2019-15690",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-15690"
}
],
"notes": [
{
"category": "general",
"text": "LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-15690",
"url": "https://www.suse.com/security/cve/CVE-2019-15690"
},
{
"category": "external",
"summary": "SUSE Bug 1160471 for CVE-2019-15690",
"url": "https://bugzilla.suse.com/1160471"
},
{
"category": "external",
"summary": "SUSE Bug 1170441 for CVE-2019-15690",
"url": "https://bugzilla.suse.com/1170441"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-15690"
},
{
"cve": "CVE-2019-20788",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20788"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20788",
"url": "https://www.suse.com/security/cve/CVE-2019-20788"
},
{
"category": "external",
"summary": "SUSE Bug 1170441 for CVE-2019-20788",
"url": "https://bugzilla.suse.com/1170441"
},
{
"category": "external",
"summary": "SUSE Bug 1173698 for CVE-2019-20788",
"url": "https://bugzilla.suse.com/1173698"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-20788"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
},
{
"cve": "CVE-2020-14403",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14403"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14403",
"url": "https://www.suse.com/security/cve/CVE-2020-14403"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14403",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14403"
},
{
"cve": "CVE-2020-14404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14404"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14404",
"url": "https://www.suse.com/security/cve/CVE-2020-14404"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14404",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14404"
},
{
"cve": "CVE-2020-25708",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25708"
}
],
"notes": [
{
"category": "general",
"text": "A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25708",
"url": "https://www.suse.com/security/cve/CVE-2020-25708"
},
{
"category": "external",
"summary": "SUSE Bug 1178682 for CVE-2020-25708",
"url": "https://bugzilla.suse.com/1178682"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:LibVNCServer-devel-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncclient1-0.9.13-3.1.x86_64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.aarch64",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.ppc64le",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.s390x",
"openSUSE Tumbleweed:libvncserver1-0.9.13-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25708"
}
]
}
opensuse-su-2020:1025-1
Vulnerability from csaf_opensuse
Published
2020-07-21 08:27
Modified
2020-07-21 08:27
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
- added patches
fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
+ LibVNCServer-CVE-2018-21247.patch
fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
+ LibVNCServer-CVE-2019-20839.patch
fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
+ LibVNCServer-CVE-2019-20840.patch
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
+ LibVNCServer-CVE-2020-14398.patch
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
+ LibVNCServer-CVE-2020-14397.patch
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
+ LibVNCServer-CVE-2020-14399.patch
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
+ LibVNCServer-CVE-2020-14400.patch
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
+ LibVNCServer-CVE-2020-14401.patch
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
+ LibVNCServer-CVE-2020-14402,14403,14404.patch
fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2020-1025
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1025",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1025-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1025-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MRXTN4MBX2MAHYVC2KCQATTKYECU2TZT/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1025-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MRXTN4MBX2MAHYVC2KCQATTKYECU2TZT/"
},
{
"category": "self",
"summary": "SUSE Bug 1173477",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173874",
"url": "https://bugzilla.suse.com/1173874"
},
{
"category": "self",
"summary": "SUSE Bug 1173875",
"url": "https://bugzilla.suse.com/1173875"
},
{
"category": "self",
"summary": "SUSE Bug 1173876",
"url": "https://bugzilla.suse.com/1173876"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-07-21T08:27:26Z",
"generator": {
"date": "2020-07-21T08:27:26Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1025-1",
"initial_release_date": "2020-07-21T08:27:26Z",
"revision_history": [
{
"date": "2020-07-21T08:27:26Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"product_id": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp152.9.8.1.i586",
"product": {
"name": "libvncclient0-0.9.10-lp152.9.8.1.i586",
"product_id": "libvncclient0-0.9.10-lp152.9.8.1.i586"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp152.9.8.1.i586",
"product": {
"name": "libvncserver0-0.9.10-lp152.9.8.1.i586",
"product_id": "libvncserver0-0.9.10-lp152.9.8.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"product": {
"name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"product_id": "libvncclient0-0.9.10-lp152.9.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64",
"product": {
"name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64",
"product_id": "libvncserver0-0.9.10-lp152.9.8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586"
},
"product_reference": "libvncclient0-0.9.10-lp152.9.8.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64"
},
"product_reference": "libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp152.9.8.1.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586"
},
"product_reference": "libvncserver0-0.9.10-lp152.9.8.1.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp152.9.8.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
},
"product_reference": "libvncserver0-0.9.10-lp152.9.8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.8.1.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-21T08:27:26Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
}
]
}
opensuse-su-2020:1056-1
Vulnerability from csaf_opensuse
Published
2020-07-24 12:20
Modified
2020-07-24 12:20
Summary
Security update for LibVNCServer
Notes
Title of the patch
Security update for LibVNCServer
Description of the patch
This update for LibVNCServer fixes the following issues:
- security update
- added patches
fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak
+ LibVNCServer-CVE-2018-21247.patch
fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()
+ LibVNCServer-CVE-2019-20839.patch
fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service
+ LibVNCServer-CVE-2019-20840.patch
fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c
+ LibVNCServer-CVE-2020-14398.patch
fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c
+ LibVNCServer-CVE-2020-14397.patch
fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.
+ LibVNCServer-CVE-2020-14399.patch
fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.
+ LibVNCServer-CVE-2020-14400.patch
fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c
+ LibVNCServer-CVE-2020-14401.patch
fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.
+ LibVNCServer-CVE-2020-14402,14403,14404.patch
fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2020-1056
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- security update\n- added patches\n fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak\n + LibVNCServer-CVE-2018-21247.patch\n fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock()\n + LibVNCServer-CVE-2019-20839.patch\n fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service\n + LibVNCServer-CVE-2019-20840.patch\n fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c\n + LibVNCServer-CVE-2020-14398.patch\n fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c\n + LibVNCServer-CVE-2020-14397.patch\n fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c.\n + LibVNCServer-CVE-2020-14399.patch\n fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c.\n + LibVNCServer-CVE-2020-14400.patch\n fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c\n + LibVNCServer-CVE-2020-14401.patch\n fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings.\n + LibVNCServer-CVE-2020-14402,14403,14404.patch\n fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1056",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1056-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1056-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWRQ72I3AY52E4KTKKWCJGWKFGVHI5FP/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1056-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWRQ72I3AY52E4KTKKWCJGWKFGVHI5FP/"
},
{
"category": "self",
"summary": "SUSE Bug 1173477",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "self",
"summary": "SUSE Bug 1173691",
"url": "https://bugzilla.suse.com/1173691"
},
{
"category": "self",
"summary": "SUSE Bug 1173694",
"url": "https://bugzilla.suse.com/1173694"
},
{
"category": "self",
"summary": "SUSE Bug 1173700",
"url": "https://bugzilla.suse.com/1173700"
},
{
"category": "self",
"summary": "SUSE Bug 1173701",
"url": "https://bugzilla.suse.com/1173701"
},
{
"category": "self",
"summary": "SUSE Bug 1173743",
"url": "https://bugzilla.suse.com/1173743"
},
{
"category": "self",
"summary": "SUSE Bug 1173874",
"url": "https://bugzilla.suse.com/1173874"
},
{
"category": "self",
"summary": "SUSE Bug 1173875",
"url": "https://bugzilla.suse.com/1173875"
},
{
"category": "self",
"summary": "SUSE Bug 1173876",
"url": "https://bugzilla.suse.com/1173876"
},
{
"category": "self",
"summary": "SUSE Bug 1173880",
"url": "https://bugzilla.suse.com/1173880"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-18922 page",
"url": "https://www.suse.com/security/cve/CVE-2017-18922/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-21247 page",
"url": "https://www.suse.com/security/cve/CVE-2018-21247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20839 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20840 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20840/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14397 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14397/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14398 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14399 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14399/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14400 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14401 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14401/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14402 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14402/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2020-07-24T12:20:15Z",
"generator": {
"date": "2020-07-24T12:20:15Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1056-1",
"initial_release_date": "2020-07-24T12:20:15Z",
"revision_history": [
{
"date": "2020-07-24T12:20:15Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"product_id": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp152.9.4.2.i586",
"product": {
"name": "libvncclient0-0.9.10-lp152.9.4.2.i586",
"product_id": "libvncclient0-0.9.10-lp152.9.4.2.i586"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp152.9.4.2.i586",
"product": {
"name": "libvncserver0-0.9.10-lp152.9.4.2.i586",
"product_id": "libvncserver0-0.9.10-lp152.9.4.2.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"product_id": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"product": {
"name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"product_id": "libvncclient0-0.9.10-lp152.9.4.2.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64",
"product": {
"name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64",
"product_id": "libvncserver0-0.9.10-lp152.9.4.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586"
},
"product_reference": "libvncclient0-0.9.10-lp152.9.4.2.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient0-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64"
},
"product_reference": "libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp152.9.4.2.i586 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586"
},
"product_reference": "libvncserver0-0.9.10-lp152.9.4.2.i586",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver0-0.9.10-lp152.9.4.2.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
},
"product_reference": "libvncserver0-0.9.10-lp152.9.4.2.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-18922"
}
],
"notes": [
{
"category": "general",
"text": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-18922",
"url": "https://www.suse.com/security/cve/CVE-2017-18922"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2017-18922",
"url": "https://bugzilla.suse.com/1173477"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "important"
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-21247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-21247"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-21247",
"url": "https://www.suse.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173874 for CVE-2018-21247",
"url": "https://bugzilla.suse.com/1173874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "important"
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-20839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20839"
}
],
"notes": [
{
"category": "general",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20839",
"url": "https://www.suse.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173875 for CVE-2019-20839",
"url": "https://bugzilla.suse.com/1173875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "important"
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20840"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20840",
"url": "https://www.suse.com/security/cve/CVE-2019-20840"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173876 for CVE-2019-20840",
"url": "https://bugzilla.suse.com/1173876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "important"
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14397",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14397"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14397",
"url": "https://www.suse.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173700 for CVE-2020-14397",
"url": "https://bugzilla.suse.com/1173700"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14398"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14398",
"url": "https://www.suse.com/security/cve/CVE-2020-14398"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173880 for CVE-2020-14398",
"url": "https://bugzilla.suse.com/1173880"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14399",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14399"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\"",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14399",
"url": "https://www.suse.com/security/cve/CVE-2020-14399"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173743 for CVE-2020-14399",
"url": "https://bugzilla.suse.com/1173743"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14399"
},
{
"cve": "CVE-2020-14400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14400"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14400",
"url": "https://www.suse.com/security/cve/CVE-2020-14400"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173691 for CVE-2020-14400",
"url": "https://bugzilla.suse.com/1173691"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14400"
},
{
"cve": "CVE-2020-14401",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14401"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14401",
"url": "https://www.suse.com/security/cve/CVE-2020-14401"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173694 for CVE-2020-14401",
"url": "https://bugzilla.suse.com/1173694"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14402"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14402",
"url": "https://www.suse.com/security/cve/CVE-2020-14402"
},
{
"category": "external",
"summary": "SUSE Bug 1173477 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173477"
},
{
"category": "external",
"summary": "SUSE Bug 1173701 for CVE-2020-14402",
"url": "https://bugzilla.suse.com/1173701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:LibVNCServer-devel-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncclient0-0.9.10-lp152.9.4.2.x86_64",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.i586",
"openSUSE Leap 15.2:libvncserver0-0.9.10-lp152.9.4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-24T12:20:15Z",
"details": "moderate"
}
],
"title": "CVE-2020-14402"
}
]
}
rhsa-2021_1811
Vulnerability from csaf_redhat
Published
2021-05-18 14:20
Modified
2024-11-22 15:59
Summary
Red Hat Security Advisory: libvncserver security update
Notes
Topic
An update for libvncserver is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.
Security Fix(es):
* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)
* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)
* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)
* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)
* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libvncserver is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.\n\nSecurity Fix(es):\n\n* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)\n\n* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)\n\n* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)\n\n* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)\n\n* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:1811",
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
},
{
"category": "external",
"summary": "1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1811.json"
}
],
"title": "Red Hat Security Advisory: libvncserver security update",
"tracking": {
"current_release_date": "2024-11-22T15:59:34+00:00",
"generator": {
"date": "2024-11-22T15:59:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:1811",
"initial_release_date": "2021-05-18T14:20:40+00:00",
"revision_history": [
{
"date": "2021-05-18T14:20:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-05-18T14:20:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:59:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product": {
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.src",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.src",
"product_id": "libvncserver-0:0.9.11-17.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-21247",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849886"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: uninitialized memory contents are vulnerable to Information Leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "RHBZ#1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-21247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: uninitialized memory contents are vulnerable to Information Leak"
},
{
"cve": "CVE-2019-20839",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849877"
}
],
"notes": [
{
"category": "description",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: buffer overflow in ConnectClientToUnixSock()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is only an issue if the \"ConnectClientToUnixSock()\" function is used directly with an overly long socket name. It\u0027s more common that the \"ConnectToRFBServer()\" function is used, which would prevent exploiting this flaw as it performs additional checks. Additionally, the buffer overflow is caught by compiled-in buffer overflow checks, limiting the impact to a crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "RHBZ#1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20839",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: buffer overflow in ConnectClientToUnixSock()"
},
{
"cve": "CVE-2020-14397",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860344"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "RHBZ#1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14397",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference"
},
{
"cve": "CVE-2020-14405",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860325"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14405"
},
{
"category": "external",
"summary": "RHBZ#1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14405",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size"
},
{
"acknowledgments": [
{
"names": [
"Hui Huang",
"Kailong Zhu",
"Lu Yu"
]
}
],
"cve": "CVE-2020-25708",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2020-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1896739"
}
],
"notes": [
{
"category": "description",
"text": "A divide by zero flaw was found in libvncserver. This flaw allows a malicious client to send a specially crafted message that, when processed by the VNC server, leads to a floating-point exception, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-25708"
},
{
"category": "external",
"summary": "RHBZ#1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-25708",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25708"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba",
"url": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/issues/409",
"url": "https://github.com/LibVNC/libvncserver/issues/409"
}
],
"release_date": "2020-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS"
}
]
}
rhsa-2021:1811
Vulnerability from csaf_redhat
Published
2021-05-18 14:20
Modified
2024-11-22 15:59
Summary
Red Hat Security Advisory: libvncserver security update
Notes
Topic
An update for libvncserver is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.
Security Fix(es):
* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)
* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)
* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)
* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)
* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libvncserver is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.\n\nSecurity Fix(es):\n\n* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)\n\n* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)\n\n* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)\n\n* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)\n\n* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:1811",
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
},
{
"category": "external",
"summary": "1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1811.json"
}
],
"title": "Red Hat Security Advisory: libvncserver security update",
"tracking": {
"current_release_date": "2024-11-22T15:59:34+00:00",
"generator": {
"date": "2024-11-22T15:59:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:1811",
"initial_release_date": "2021-05-18T14:20:40+00:00",
"revision_history": [
{
"date": "2021-05-18T14:20:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-05-18T14:20:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:59:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product": {
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.src",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.src",
"product_id": "libvncserver-0:0.9.11-17.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-21247",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849886"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: uninitialized memory contents are vulnerable to Information Leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "RHBZ#1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-21247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: uninitialized memory contents are vulnerable to Information Leak"
},
{
"cve": "CVE-2019-20839",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849877"
}
],
"notes": [
{
"category": "description",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: buffer overflow in ConnectClientToUnixSock()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is only an issue if the \"ConnectClientToUnixSock()\" function is used directly with an overly long socket name. It\u0027s more common that the \"ConnectToRFBServer()\" function is used, which would prevent exploiting this flaw as it performs additional checks. Additionally, the buffer overflow is caught by compiled-in buffer overflow checks, limiting the impact to a crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "RHBZ#1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20839",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: buffer overflow in ConnectClientToUnixSock()"
},
{
"cve": "CVE-2020-14397",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860344"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "RHBZ#1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14397",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference"
},
{
"cve": "CVE-2020-14405",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860325"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14405"
},
{
"category": "external",
"summary": "RHBZ#1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14405",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size"
},
{
"acknowledgments": [
{
"names": [
"Hui Huang",
"Kailong Zhu",
"Lu Yu"
]
}
],
"cve": "CVE-2020-25708",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2020-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1896739"
}
],
"notes": [
{
"category": "description",
"text": "A divide by zero flaw was found in libvncserver. This flaw allows a malicious client to send a specially crafted message that, when processed by the VNC server, leads to a floating-point exception, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-25708"
},
{
"category": "external",
"summary": "RHBZ#1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-25708",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25708"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba",
"url": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/issues/409",
"url": "https://github.com/LibVNC/libvncserver/issues/409"
}
],
"release_date": "2020-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS"
}
]
}
RHSA-2021:1811
Vulnerability from csaf_redhat
Published
2021-05-18 14:20
Modified
2024-11-22 15:59
Summary
Red Hat Security Advisory: libvncserver security update
Notes
Topic
An update for libvncserver is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.
Security Fix(es):
* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)
* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)
* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)
* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)
* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libvncserver is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.\n\nSecurity Fix(es):\n\n* libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)\n\n* libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)\n\n* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)\n\n* libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)\n\n* libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:1811",
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
},
{
"category": "external",
"summary": "1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1811.json"
}
],
"title": "Red Hat Security Advisory: libvncserver security update",
"tracking": {
"current_release_date": "2024-11-22T15:59:34+00:00",
"generator": {
"date": "2024-11-22T15:59:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:1811",
"initial_release_date": "2021-05-18T14:20:40+00:00",
"revision_history": [
{
"date": "2021-05-18T14:20:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-05-18T14:20:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T15:59:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product": {
"name": "Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debugsource@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-debuginfo@0.9.11-17.el8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_id": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver-devel@0.9.11-17.el8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libvncserver-0:0.9.11-17.el8.src",
"product": {
"name": "libvncserver-0:0.9.11-17.el8.src",
"product_id": "libvncserver-0:0.9.11-17.el8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libvncserver@0.9.11-17.el8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.src as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.src",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.aarch64",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.i686 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.i686",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.s390x as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.s390x",
"relates_to_product_reference": "CRB-8.4.0.GA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver-devel-0:0.9.11-17.el8.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 8)",
"product_id": "CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
},
"product_reference": "libvncserver-devel-0:0.9.11-17.el8.x86_64",
"relates_to_product_reference": "CRB-8.4.0.GA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-21247",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849886"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: uninitialized memory contents are vulnerable to Information Leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-21247"
},
{
"category": "external",
"summary": "RHBZ#1849886",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849886"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-21247",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-21247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: uninitialized memory contents are vulnerable to Information Leak"
},
{
"cve": "CVE-2019-20839",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1849877"
}
],
"notes": [
{
"category": "description",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: buffer overflow in ConnectClientToUnixSock()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is only an issue if the \"ConnectClientToUnixSock()\" function is used directly with an overly long socket name. It\u0027s more common that the \"ConnectToRFBServer()\" function is used, which would prevent exploiting this flaw as it performs additional checks. Additionally, the buffer overflow is caught by compiled-in buffer overflow checks, limiting the impact to a crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20839"
},
{
"category": "external",
"summary": "RHBZ#1849877",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1849877"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20839",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20839"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: buffer overflow in ConnectClientToUnixSock()"
},
{
"cve": "CVE-2020-14397",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860344"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14397"
},
{
"category": "external",
"summary": "RHBZ#1860344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14397",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference"
},
{
"cve": "CVE-2020-14405",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2020-06-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1860325"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14405"
},
{
"category": "external",
"summary": "RHBZ#1860325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14405",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405"
}
],
"release_date": "2020-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncclient/rfbproto.c does not limit TextChat size"
},
{
"acknowledgments": [
{
"names": [
"Hui Huang",
"Kailong Zhu",
"Lu Yu"
]
}
],
"cve": "CVE-2020-25708",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"discovery_date": "2020-11-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1896739"
}
],
"notes": [
{
"category": "description",
"text": "A divide by zero flaw was found in libvncserver. This flaw allows a malicious client to send a specially crafted message that, when processed by the VNC server, leads to a floating-point exception, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-25708"
},
{
"category": "external",
"summary": "RHBZ#1896739",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896739"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-25708",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25708"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba",
"url": "https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba"
},
{
"category": "external",
"summary": "https://github.com/LibVNC/libvncserver/issues/409",
"url": "https://github.com/LibVNC/libvncserver/issues/409"
}
],
"release_date": "2020-05-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-05-18T14:20:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1811"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"AppStream-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"AppStream-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.src",
"CRB-8.4.0.GA:libvncserver-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debuginfo-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-debugsource-0:0.9.11-17.el8.x86_64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.aarch64",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.i686",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.ppc64le",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.s390x",
"CRB-8.4.0.GA:libvncserver-devel-0:0.9.11-17.el8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS"
}
]
}
icsa-21-350-12
Vulnerability from csaf_cisa
Published
2021-12-16 00:00
Modified
2021-12-16 00:00
Summary
Siemens SIMATIC ITC
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.",
"title": "Risk evaluation"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-390195.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-12 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-350-12.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-12 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-12"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
},
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-390195.txt"
}
],
"title": "Siemens SIMATIC ITC",
"tracking": {
"current_release_date": "2021-12-16T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-350-12",
"initial_release_date": "2021-12-16T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-12-16T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-350-12 Siemens SIMATIC ITC"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1500 V3",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1500 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1500 V3 PRO",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1500 V3 PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1900 V3",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1900 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1900 V3 PRO",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1900 V3 PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC2200 V3",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC2200 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC2200 V3 PRO",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC2200 V3 PRO"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2017-18922 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2017-18922.json"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18922"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20019"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20748"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20749"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20750"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-21247"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15681"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15690"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20788"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20839"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20840"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14396"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14397"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14398"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14401"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14402"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14403"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14404"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14405"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-20019",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20019 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20019.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20019"
},
{
"cve": "CVE-2018-20748",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20748 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20748.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20748"
},
{
"cve": "CVE-2018-20749",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20749 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20749.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20749"
},
{
"cve": "CVE-2018-20750",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20750 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20750.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20750"
},
{
"cve": "CVE-2018-21247",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-21247 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-21247.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-15681",
"cwe": {
"id": "CWE-665",
"name": "Improper Initialization"
},
"notes": [
{
"category": "summary",
"text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-15681 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15681.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-15681"
},
{
"cve": "CVE-2019-15690",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in libvncserver. An integer overflow within the HandleCursorShape() function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted dimensions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-15690 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15690.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-15690"
},
{
"cve": "CVE-2019-20788",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20788 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20788.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20788"
},
{
"cve": "CVE-2019-20839",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20839 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20839.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20840 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20840.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14396",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14396 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14396.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14396"
},
{
"cve": "CVE-2020-14397",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14397 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14397.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14398 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14398.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14401",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14401 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14401.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14402 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14402.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14402"
},
{
"cve": "CVE-2020-14403",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14403 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14403.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14403"
},
{
"cve": "CVE-2020-14404",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14404 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14404.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14404"
},
{
"cve": "CVE-2020-14405",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14405 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14405.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14405"
}
]
}
ICSA-21-350-12
Vulnerability from csaf_cisa
Published
2021-12-16 00:00
Modified
2021-12-16 00:00
Summary
Siemens SIMATIC ITC
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Exploitability
No known public exploits specifically target these vulnerabilities.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these LibVNC vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks.",
"title": "Risk evaluation"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-390195.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-12 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-350-12.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-350-12 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-12"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
},
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"category": "external",
"summary": "SSA-390195: LibVNC Vulnerabilities in SIMATIC ITC Products - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-390195.txt"
}
],
"title": "Siemens SIMATIC ITC",
"tracking": {
"current_release_date": "2021-12-16T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-350-12",
"initial_release_date": "2021-12-16T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-12-16T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-350-12 Siemens SIMATIC ITC"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1500 V3",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1500 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1500 V3 PRO",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1500 V3 PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1900 V3",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1900 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC1900 V3 PRO",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC1900 V3 PRO"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC2200 V3",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC2200 V3"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c V3.2.1.0",
"product": {
"name": "SIMATIC ITC2200 V3 PRO",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMATIC ITC2200 V3 PRO"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-18922",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2017-18922 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2017-18922 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2017-18922.json"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18922"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20019"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20748"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20749"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20750"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-21247"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15681"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15690"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20788"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20839"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20840"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14396"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14397"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14398"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14401"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14402"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14403"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14404"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14405"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2017-18922"
},
{
"cve": "CVE-2018-20019",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20019 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20019 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20019.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20019"
},
{
"cve": "CVE-2018-20748",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20748 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20748 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20748.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20748"
},
{
"cve": "CVE-2018-20749",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20749 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20749 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20749.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20749"
},
{
"cve": "CVE-2018-20750",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-20750 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-20750 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-20750.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-20750"
},
{
"cve": "CVE-2018-21247",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2018-21247 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2018-21247 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2018-21247.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2018-21247"
},
{
"cve": "CVE-2019-15681",
"cwe": {
"id": "CWE-665",
"name": "Improper Initialization"
},
"notes": [
{
"category": "summary",
"text": "LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-15681 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15681 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15681.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-15681"
},
{
"cve": "CVE-2019-15690",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in libvncserver. An integer overflow within the HandleCursorShape() function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted dimensions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-15690 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-15690 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-15690.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-15690"
},
{
"cve": "CVE-2019-20788",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20788 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20788 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20788.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20788"
},
{
"cve": "CVE-2019-20839",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20839 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20839 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20839.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20839"
},
{
"cve": "CVE-2019-20840",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2019-20840 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2019-20840 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2019-20840.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2019-20840"
},
{
"cve": "CVE-2020-14396",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14396 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14396 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14396.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14396"
},
{
"cve": "CVE-2020-14397",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14397 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14397 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14397.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14397"
},
{
"cve": "CVE-2020-14398",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14398 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14398 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14398.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14398"
},
{
"cve": "CVE-2020-14401",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14401 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14401 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14401.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14401"
},
{
"cve": "CVE-2020-14402",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14402 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14402 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14402.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14402"
},
{
"cve": "CVE-2020-14403",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14403 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14403 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14403.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14403"
},
{
"cve": "CVE-2020-14404",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14404 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14404 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14404.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14404"
},
{
"cve": "CVE-2020-14405",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"summary": "CVE-2020-14405 - SIMATIC ITC1500 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1500 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1900 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC1900 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC2200 V3",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 - SIMATIC ITC2200 V3 PRO",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"summary": "CVE-2020-14405 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14405.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to V3.2.1.0 or later version",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109804128/"
},
{
"category": "mitigation",
"details": "Monitor and restrict access to port 5900/tcp to trusted IP addresses only",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"title": "CVE-2020-14405"
}
]
}
cnvd-2020-36783
Vulnerability from cnvd
Title: LibVNCServer代码问题漏洞
Description:
LibVNCServer是一款支持在程序中实现VNC（虚拟网络计算）服务器或客户端功能的跨平台C语言库。
LibVNCServer 0.9.13之前版本中的libvncserver/rfbregion.c文件存在代码问题漏洞。远程攻击者可利用该漏洞导致应用程序崩溃。
Severity: 中
Patch Name: LibVNCServer代码问题漏洞的补丁
Patch Description:
LibVNCServer是一款支持在程序中实现VNC（虚拟网络计算）服务器或客户端功能的跨平台C语言库。
LibVNCServer 0.9.13之前版本中的libvncserver/rfbregion.c文件存在代码问题漏洞。远程攻击者可利用该漏洞导致应用程序崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description:
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0
Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-14397
Impacted products
| Name | LibVNCServer LibVNCServer <0.9.13 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-14397"
}
},
"description": "LibVNCServer\u662f\u4e00\u6b3e\u652f\u6301\u5728\u7a0b\u5e8f\u4e2d\u5b9e\u73b0VNC\uff08\u865a\u62df\u7f51\u7edc\u8ba1\u7b97\uff09\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u529f\u80fd\u7684\u8de8\u5e73\u53f0C\u8bed\u8a00\u5e93\u3002\n\nLibVNCServer 0.9.13\u4e4b\u524d\u7248\u672c\u4e2d\u7684libvncserver/rfbregion.c\u6587\u4ef6\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-36783",
"openTime": "2020-07-07",
"patchDescription": "LibVNCServer\u662f\u4e00\u6b3e\u652f\u6301\u5728\u7a0b\u5e8f\u4e2d\u5b9e\u73b0VNC\uff08\u865a\u62df\u7f51\u7edc\u8ba1\u7b97\uff09\u670d\u52a1\u5668\u6216\u5ba2\u6237\u7aef\u529f\u80fd\u7684\u8de8\u5e73\u53f0C\u8bed\u8a00\u5e93\u3002\r\n\r\nLibVNCServer 0.9.13\u4e4b\u524d\u7248\u672c\u4e2d\u7684libvncserver/rfbregion.c\u6587\u4ef6\u5b58\u5728\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "LibVNCServer\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "LibVNCServer LibVNCServer \u003c0.9.13"
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"serverity": "\u4e2d",
"submitTime": "2020-06-18",
"title": "LibVNCServer\u4ee3\u7801\u95ee\u9898\u6f0f\u6d1e"
}
ghsa-q22w-mmf2-x3mr
Vulnerability from github
Published
2022-05-24 17:20
Modified
2022-05-24 17:20
Severity ?
VLAI Severity ?
Details
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
{
"affected": [],
"aliases": [
"CVE-2020-14397"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-17T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"id": "GHSA-q22w-mmf2-x3mr",
"modified": "2022-05-24T17:20:47Z",
"published": "2022-05-24T17:20:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397"
},
{
"type": "WEB",
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"type": "WEB",
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4434-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4573-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
fkie_cve-2020-14397
Vulnerability from fkie_nvd
Published
2020-06-17 16:15
Modified
2024-11-21 05:03
Severity ?
Summary
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| libvnc_project | libvncserver | * | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 16.04 | |
| canonical | ubuntu_linux | 18.04 | |
| canonical | ubuntu_linux | 18.10 | |
| canonical | ubuntu_linux | 20.04 | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 | |
| siemens | simatic_itc1500_firmware | * | |
| siemens | simatic_itc1500 | - | |
| siemens | simatic_itc1500_pro_firmware | * | |
| siemens | simatic_itc1500_pro | - | |
| siemens | simatic_itc1900_firmware | * | |
| siemens | simatic_itc1900 | - | |
| siemens | simatic_itc1900_pro_firmware | * | |
| siemens | simatic_itc1900_pro | - | |
| siemens | simatic_itc2200_firmware | * | |
| siemens | simatic_itc2200 | - | |
| siemens | simatic_itc2200_pro_firmware | * | |
| siemens | simatic_itc2200_pro | - | |
| opensuse | leap | 15.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A03A7282-D445-4E26-98A0-6A1597838D35",
"versionEndIncluding": "0.9.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A664216-EEA0-423F-8E11-59C746FDEEFE",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc1500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9596C8CD-B03F-4E9D-82AB-0986FDD1B47C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD78291E-48D8-4718-AE14-BDF93BD557D7",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc1500_pro:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5BB898D3-07A3-42A1-8F1B-53C3B005982D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD1209DE-2724-493D-8276-1BE959BFE6BF",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc1900:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6A9143A6-A93A-45CA-8A1F-6EE30647B54A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "92F7FC17-F19F-4BD6-9704-49B67D22B532",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc1900_pro:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D34BD13-4E71-48A2-851D-AE7CE2A03C28",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FE4A6F13-385B-4A13-B8D8-3BBC4E9D5B67",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc2200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3E63E423-7450-4043-B33B-3FFF5BBE1CB2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71A51CA4-1A62-47BC-99A3-4DC9F3986FF5",
"versionEndExcluding": "3.2.1.0",
"versionStartIncluding": "3.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:simatic_itc2200_pro:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CD278558-AB0E-4FC1-9E5B-6B57D29CB86A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/rfbregion.c presenta una desreferencia del puntero NULL"
}
],
"id": "CVE-2020-14397",
"lastModified": "2024-11-21T05:03:10.483",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-17T16:15:11.773",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4573-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4434-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4573-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…