Test ID:	1.3.6.1.4.1.25623.1.1.4.2020.2167.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2020:2167-1)
Summary:	The remote host is missing an update for the 'LibVNCServer' package(s) announced via the SUSE-SU-2020:2167-1 advisory.
Description:	Summary: The remote host is missing an update for the 'LibVNCServer' package(s) announced via the SUSE-SU-2020:2167-1 advisory. Vulnerability Insight: This update for LibVNCServer fixes the following issues: - security update fix CVE-2018-21247 [bsc#1173874], uninitialized memory contents are vulnerable to Information leak fix CVE-2019-20839 [bsc#1173875], buffer overflow in ConnectClientToUnixSock() fix CVE-2019-20840 [bsc#1173876], unaligned accesses in hybiReadAndDecode can lead to denial of service fix CVE-2020-14398 [bsc#1173880], improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c fix CVE-2020-14397 [bsc#1173700], NULL pointer dereference in libvncserver/rfbregion.c fix CVE-2020-14399 [bsc#1173743], Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. fix CVE-2020-14400 [bsc#1173691], Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. fix CVE-2020-14401 [bsc#1173694], potential integer overflows in libvncserver/scale.c fix CVE-2020-14402 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14403 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2020-14404 [bsc#1173701], out-of-bounds access via encodings. fix CVE-2017-18922 [bsc#1173477], preauth buffer overwrite Affected Software/OS: 'LibVNCServer' package(s) on SUSE Linux Enterprise Server 12-SP2, SUSE Linux Enterprise Server 12-SP3, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server for SAP Applications 12-SP2, SUSE Linux Enterprise Server for SAP Applications 12-SP3, SUSE Linux Enterprise Server for SAP Applications 12-SP4, SUSE Linux Enterprise Server for SAP Applications 12-SP5. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-18922 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/ https://bugzilla.redhat.com/show_bug.cgi?id=1852356 https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433 https://www.openwall.com/lists/oss-security/2020/06/30/2 http://www.openwall.com/lists/oss-security/2020/06/30/3 SuSE Security Announcement: openSUSE-SU-2020:0960 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html SuSE Security Announcement: openSUSE-SU-2020:0978 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html SuSE Security Announcement: openSUSE-SU-2020:0988 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html SuSE Security Announcement: openSUSE-SU-2020:1025 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html SuSE Security Announcement: openSUSE-SU-2020:1056 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html https://usn.ubuntu.com/4407-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-21247 https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13 https://github.com/LibVNC/libvncserver/issues/253 Common Vulnerability Exposure (CVE) ID: CVE-2019-20839 https://github.com/LibVNC/libvncserver/commit/3fd03977c9b35800d73a865f167338cb4d05b0c1 https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html https://usn.ubuntu.com/4434-1/ Common Vulnerability Exposure (CVE) ID: CVE-2019-20840 https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76 Common Vulnerability Exposure (CVE) ID: CVE-2020-14397 https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0 https://usn.ubuntu.com/4573-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14398 https://github.com/LibVNC/libvncserver/commit/57433015f856cc12753378254ce4f1c78f5d9c7b Common Vulnerability Exposure (CVE) ID: CVE-2020-14399 https://bugzilla.redhat.com/show_bug.cgi?id=1860354 https://github.com/LibVNC/libvncserver/commit/23e5cbe6b090d7f22982aee909a6a618174d3c2d Common Vulnerability Exposure (CVE) ID: CVE-2020-14400 https://bugzilla.redhat.com/show_bug.cgi?id=1860361 https://github.com/LibVNC/libvncserver/commit/53073c8d7e232151ea2ecd8a1243124121e10e2d Common Vulnerability Exposure (CVE) ID: CVE-2020-14401 https://github.com/LibVNC/libvncserver/commit/a6788d1da719ae006605b78d22f5a9f170b423af Common Vulnerability Exposure (CVE) ID: CVE-2020-14402 https://github.com/LibVNC/libvncserver/commit/74e8a70f2c9a5248d6718ce443e07c7ed314dfff Common Vulnerability Exposure (CVE) ID: CVE-2020-14403 Common Vulnerability Exposure (CVE) ID: CVE-2020-14404
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.