USN-4573-1: Vino vulnerabilities
7 October 2020
Several security issues were fixed in Vino.
Releases
Packages
- vino - VNC server for GNOME
Details
Nicolas Ruff discovered that Vino incorrectly handled large ClientCutText
messages. A remote attacker could use this issue to cause the server to
crash, resulting in a denial of service. (CVE-2014-6053)
It was discovered that Vino incorrectly handled certain packet lengths. A
remote attacker could possibly use this issue to obtain sensitive
information, cause a denial of service, or execute arbitrary code.
(CVE-2018-7225)
Pavel Cheremushkin discovered that an information disclosure vulnerability
existed in Vino when sending a ServerCutText message. An attacker could
possibly use this issue to expose sensitive information. (CVE-2019-15681)
It was discovered that Vino incorrectly handled region clipping. A remote
attacker could possibly use this issue to cause Vino to crash, resulting in
a denial of service. (CVE-2020-14397)
It was discovered that Vino incorrectly handled encodings. A remote
attacker could use this issue to cause Vino to crash, resulting in a denial
of service, or possibly execute arbitrary code. (CVE-2020-14402,
CVE-2020-14403, CVE-2020-14404)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
After a standard system update you need to restart your session to make all
the necessary changes.
Related notices
- USN-2365-1: libvncserver-dev, libvncserver0, linuxvnc, libvncserver-config, libvncserver
- USN-4587-1: libitalccore, italc-master, italc-management-console, italc-client, italc
- USN-3618-1: libvncserver-dev, libvncclient1, libvncserver0, linuxvnc, libvncserver-config, libvncserver, libvncserver1
- USN-4547-1: libitalccore, italc-master, italc-client, italc
- USN-4407-1: libvncserver-dev, libvncclient1, libvncserver-config, libvncserver, libvncserver1
- USN-4434-1: libvncserver-dev, libvncclient1, libvncserver-config, libvncserver, libvncserver1