2024-04-16 14:26:14 +00:00

498 lines
24 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20202694",
"Version": "oval:org.altlinux.errata:def:20202694",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2020-2694: package `libvncserver` update to version 0.9.13-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p9"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2020-2694",
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-2694",
"Source": "ALTPU"
},
{
"RefID": "BDU:2020-03149",
"RefURL": "https://bdu.fstec.ru/vul/2020-03149",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03151",
"RefURL": "https://bdu.fstec.ru/vul/2020-03151",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03152",
"RefURL": "https://bdu.fstec.ru/vul/2020-03152",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03153",
"RefURL": "https://bdu.fstec.ru/vul/2020-03153",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03154",
"RefURL": "https://bdu.fstec.ru/vul/2020-03154",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03155",
"RefURL": "https://bdu.fstec.ru/vul/2020-03155",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03156",
"RefURL": "https://bdu.fstec.ru/vul/2020-03156",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03157",
"RefURL": "https://bdu.fstec.ru/vul/2020-03157",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03158",
"RefURL": "https://bdu.fstec.ru/vul/2020-03158",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03159",
"RefURL": "https://bdu.fstec.ru/vul/2020-03159",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03958",
"RefURL": "https://bdu.fstec.ru/vul/2020-03958",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03737",
"RefURL": "https://bdu.fstec.ru/vul/2021-03737",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03751",
"RefURL": "https://bdu.fstec.ru/vul/2021-03751",
"Source": "BDU"
},
{
"RefID": "CVE-2018-21247",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247",
"Source": "CVE"
},
{
"RefID": "CVE-2019-20788",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-20788",
"Source": "CVE"
},
{
"RefID": "CVE-2019-20839",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839",
"Source": "CVE"
},
{
"RefID": "CVE-2019-20840",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-20840",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14396",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14396",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14397",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14398",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14398",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14399",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14399",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14400",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14400",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14401",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14401",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14402",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14402",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14403",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14403",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14404",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14404",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14405",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405",
"Source": "CVE"
},
{
"RefID": "CVE-2020-25708",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708",
"Source": "CVE"
}
],
"Description": "This update upgrades libvncserver to version 0.9.13-alt1. \nSecurity Fix(es):\n\n * BDU:2020-03149: Уязвимость компонента libvncclient/rfbproto.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-03151: Уязвимость компонента libvncserver/rre.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-03152: Уязвимость компонента libvncserver/hextile.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-03153: Уязвимость компонента libvncserver/corre.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-03154: Уязвимость компонента libvncserver/scale.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2020-03155: Уязвимость компонента libvncserver/translate.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03156: Уязвимость компонента libvncclient/tls_openssl.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03157: Уязвимость компонента libvncserver/rfbregion.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03158: Уязвимость компонента libvncclient/sockets.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03159: Уязвимость компонента libvncclient/rfbproto.c кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-03958: Уязвимость реализации функции ConnectToRFBRepeater кроссплатформенной библиотеки LibVNCServer, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2021-03737: Уязвимость программного обеспечения для реализации VNC функций LibVNCServer, связанная с отсутствием проверки деления на ноль, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2021-03751: Уязвимость компонента libvncclient/sockets.c программного обеспечения для реализации VNC функций LibVNCServer, связанная с переполнением буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2018-21247: An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.\n\n * CVE-2019-20788: libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.\n\n * CVE-2019-20839: libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.\n\n * CVE-2019-20840: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.\n\n * CVE-2020-14396: An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference.\n\n * CVE-2020-14397: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.\n\n * CVE-2020-14398: An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.\n\n * CVE-2020-14399: An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly \"no trust boundary crossed.\n\n * CVE-2020-14400: An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary\n\n * CVE-2020-14401: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.\n\n * CVE-2020-14402: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.\n\n * CVE-2020-14403: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.\n\n * CVE-2020-14404: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings.\n\n * CVE-2020-14405: An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.\n\n * CVE-2020-25708: A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2020-08-27"
},
"Updated": {
"Date": "2020-08-27"
},
"BDUs": [
{
"ID": "BDU:2020-03149",
"CVSS": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-770",
"Href": "https://bdu.fstec.ru/vul/2020-03149",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03151",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2020-03151",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03152",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2020-03152",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03153",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2020-03153",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03154",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"CWE": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2020-03154",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03155",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-17",
"Href": "https://bdu.fstec.ru/vul/2020-03155",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "BDU:2020-03156",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2020-03156",
"Impact": "High",
"Public": "20191218"
},
{
"ID": "BDU:2020-03157",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2020-03157",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "BDU:2020-03158",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-835",
"Href": "https://bdu.fstec.ru/vul/2020-03158",
"Impact": "High",
"Public": "20191218"
},
{
"ID": "BDU:2020-03159",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CWE": "CWE-17",
"Href": "https://bdu.fstec.ru/vul/2020-03159",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "BDU:2020-03958",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2020-03958",
"Impact": "High",
"Public": "20180911"
},
{
"ID": "BDU:2021-03737",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-369",
"Href": "https://bdu.fstec.ru/vul/2021-03737",
"Impact": "High",
"Public": "20201127"
},
{
"ID": "BDU:2021-03751",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-120",
"Href": "https://bdu.fstec.ru/vul/2021-03751",
"Impact": "High",
"Public": "20200617"
}
],
"CVEs": [
{
"ID": "CVE-2018-21247",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-909",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-21247",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2019-20788",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-20788",
"Impact": "Critical",
"Public": "20200423"
},
{
"ID": "CVE-2019-20839",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-120",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-20839",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2019-20840",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-20840",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14396",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14396",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14397",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14397",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14398",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-835",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14398",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14399",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14399",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14400",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14400",
"Impact": "High",
"Public": "20200617"
},
{
"ID": "CVE-2020-14401",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"CWE": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14401",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "CVE-2020-14402",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14402",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "CVE-2020-14403",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14403",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "CVE-2020-14404",
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14404",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "CVE-2020-14405",
"CVSS": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-770",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14405",
"Impact": "Low",
"Public": "20200617"
},
{
"ID": "CVE-2020-25708",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-369",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-25708",
"Impact": "High",
"Public": "20201127"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:9",
"cpe:/o:alt:workstation:9",
"cpe:/o:alt:server:9",
"cpe:/o:alt:server-v:9",
"cpe:/o:alt:education:9",
"cpe:/o:alt:slinux:9",
"cpe:/o:alt:starterkit:p9",
"cpe:/o:alt:kworkstation:9.1",
"cpe:/o:alt:workstation:9.1",
"cpe:/o:alt:server:9.1",
"cpe:/o:alt:server-v:9.1",
"cpe:/o:alt:education:9.1",
"cpe:/o:alt:slinux:9.1",
"cpe:/o:alt:starterkit:9.1",
"cpe:/o:alt:kworkstation:9.2",
"cpe:/o:alt:workstation:9.2",
"cpe:/o:alt:server:9.2",
"cpe:/o:alt:server-v:9.2",
"cpe:/o:alt:education:9.2",
"cpe:/o:alt:slinux:9.2",
"cpe:/o:alt:starterkit:9.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:1001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20202694001",
"Comment": "libvncclient0 is earlier than 0:0.9.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202694002",
"Comment": "libvncserver is earlier than 0:0.9.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202694003",
"Comment": "libvncserver-devel is earlier than 0:0.9.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202694004",
"Comment": "libvncserver0 is earlier than 0:0.9.13-alt1"
}
]
}
]
}
}
]
}