Lucene search

K
mageiaGentoo FoundationMGASA-2014-0466
HistoryNov 21, 2014 - 3:44 p.m.

Updated kdenetwork4 packages fix security vulnerabilities in krfb

2014-11-2115:44:16
Gentoo Foundation
advisories.mageia.org
21

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.886

Percentile

98.8%

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054). A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055). The krfb package is built with a bundled copy of libvncserver.

OSVersionArchitecturePackageVersionFilename
Mageia3noarchkdenetwork4< 4.10.5-1.3kdenetwork4-4.10.5-1.3.mga3

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.886

Percentile

98.8%