[SECURITY] [DSA 3081-1] libvncserver security update

2014-11-2915:21:35

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

High

EPSS

0.886

Percentile

98.8%

JSON

Debian Security Advisory DSA-3081-1 [email protected]
http://www.debian.org/security/ Luciano Bello
November 29, 2014 http://www.debian.org/security/faq

Package : libvncserver
CVE ID : CVE-2014-6051 CVE-2014-6052 CVE-2014-6053 CVE-2014-6054
CVE-2014-6055
Debian Bug : 762745

Several vulnerabilities have been discovered in libvncserver, a library to
implement VNC server functionality. These vulnerabilities might result in the
execution of arbitrary code or denial of service in both the client and the
server side.

For the stable distribution (wheezy), these problems have been fixed in
version 0.9.9+dfsg-1+deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 0.9.9+dfsg-6.1.

We recommend that you upgrade your libvncserver packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9ppc64eltightvncserver-dbgsym< 1:1.3.9-9+deb9u1tightvncserver-dbgsym_1:1.3.9-9+deb9u1_ppc64el.deb
Debian7mipsellibvncserver0< 0.9.9+dfsg-1+deb7u1libvncserver0_0.9.9+dfsg-1+deb7u1_mipsel.deb
Debian7i386libvncserver-config< 0.9.9+dfsg-1+deb7u1libvncserver-config_0.9.9+dfsg-1+deb7u1_i386.deb
Debian7s390libvncserver0-dbg< 0.9.9+dfsg-1+deb7u1libvncserver0-dbg_0.9.9+dfsg-1+deb7u1_s390.deb
Debian8i386tightvncserver< 1.3.9-6.5+deb8u1tightvncserver_1.3.9-6.5+deb8u1_i386.deb
Debian7mipsellibvncserver-config< 0.9.9+dfsg-1+deb7u1libvncserver-config_0.9.9+dfsg-1+deb7u1_mipsel.deb
Debian6i386libvncserver0< 0.9.7-2+deb6u1libvncserver0_0.9.7-2+deb6u1_i386.deb
Debian7armellibvncserver0-dbg< 0.9.9+dfsg-1+deb7u1libvncserver0-dbg_0.9.9+dfsg-1+deb7u1_armel.deb
Debian7s390linuxvnc< 0.9.9+dfsg-1+deb7u1linuxvnc_0.9.9+dfsg-1+deb7u1_s390.deb
Debian6amd64libvncserver0-dbg< 0.9.7-2+deb6u1libvncserver0-dbg_0.9.7-2+deb6u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	ppc64el	tightvncserver-dbgsym	< 1:1.3.9-9+deb9u1	tightvncserver-dbgsym_1:1.3.9-9+deb9u1_ppc64el.deb
Debian	7	mipsel	libvncserver0	< 0.9.9+dfsg-1+deb7u1	libvncserver0_0.9.9+dfsg-1+deb7u1_mipsel.deb
Debian	7	i386	libvncserver-config	< 0.9.9+dfsg-1+deb7u1	libvncserver-config_0.9.9+dfsg-1+deb7u1_i386.deb
Debian	7	s390	libvncserver0-dbg	< 0.9.9+dfsg-1+deb7u1	libvncserver0-dbg_0.9.9+dfsg-1+deb7u1_s390.deb
Debian	8	i386	tightvncserver	< 1.3.9-6.5+deb8u1	tightvncserver_1.3.9-6.5+deb8u1_i386.deb
Debian	7	mipsel	libvncserver-config	< 0.9.9+dfsg-1+deb7u1	libvncserver-config_0.9.9+dfsg-1+deb7u1_mipsel.deb
Debian	6	i386	libvncserver0	< 0.9.7-2+deb6u1	libvncserver0_0.9.7-2+deb6u1_i386.deb
Debian	7	armel	libvncserver0-dbg	< 0.9.9+dfsg-1+deb7u1	libvncserver0-dbg_0.9.9+dfsg-1+deb7u1_armel.deb
Debian	7	s390	linuxvnc	< 0.9.9+dfsg-1+deb7u1	linuxvnc_0.9.9+dfsg-1+deb7u1_s390.deb
Debian	6	amd64	libvncserver0-dbg	< 0.9.7-2+deb6u1	libvncserver0-dbg_0.9.7-2+deb6u1_amd64.deb