Bug 605326 (CVE-2016-9941, CVE-2016-9942)

Summary:	<net-libs/libvncserver-0.9.11: multiple vulnerabilities (CVE-2016-{9941,9942})
Product:	Gentoo Security	Reporter:	Thomas Deutschmann (RETIRED) <whissi>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	alex_y_xu, proxy-maint
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa cve]
Package list:	=net-libs/libvncserver-0.9.11-r1	Runtime testing required:	Yes
Bug Depends on:	604192
Bug Blocks:

Description Thomas Deutschmann (RETIRED) gentoo-dev

2017-01-11 00:38:41 UTC

Incoming CVE details

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2017-01-11 00:39:11 UTC

CVE-2016-9942 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9942):
  Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before
  0.9.11 allows remote servers to cause a denial of service (application
  crash) or possibly execute arbitrary code via a crafted FramebufferUpdate
  message with the Ultra type tile, such that the LZO payload decompressed
  length exceeds what is specified by the tile dimensions.

CVE-2016-9941 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9941):
  Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer
  before 0.9.11 allows remote servers to cause a denial of service
  (application crash) or possibly execute arbitrary code via a crafted
  FramebufferUpdate message containing a subrectangle outside of the client
  drawing area.

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2017-01-11 00:42:09 UTC

@ Maintainer(s): Please bump to >=net-libs/libvncserve-0.9.11 and let us know if it is ready for the stabilization or how long you want to wait.

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2017-01-20 20:10:03 UTC

Now in repository, https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=13bf08599c6d332501292db40aea7b9179efc257


@ Arches,

please test and mark stable: =net-libs/libvncserver-0.9.11

Comment 4 Alex Xu (Hello71) 2017-01-20 20:20:50 UTC

test with x11vnc or similar

Comment 5 Tobias Klausmann (RETIRED) gentoo-dev

2017-01-21 11:44:19 UTC

Stable on alpha.

Comment 6 Jeroen Roovers (RETIRED) gentoo-dev

2017-01-21 12:21:59 UTC

Stable for PPC64.

Comment 7 Jeroen Roovers (RETIRED) gentoo-dev

2017-01-21 12:23:01 UTC

Stable for HPPA.

Comment 8 Agostino Sarubbo gentoo-dev

2017-01-21 17:16:49 UTC

amd64 stable

Comment 9 Agostino Sarubbo gentoo-dev

2017-01-21 17:27:37 UTC

x86 stable

Comment 10 Agostino Sarubbo gentoo-dev

2017-01-21 20:34:16 UTC

ppc stable

Comment 11 Agostino Sarubbo gentoo-dev

2017-01-22 16:29:40 UTC

sparc stable

Comment 12 Agostino Sarubbo gentoo-dev

2017-01-23 16:28:35 UTC

ia64 stable

Comment 13 Markus Meier gentoo-dev

2017-02-05 17:00:58 UTC

arm stable, all arches done.

Comment 14 Aaron Bauman (RETIRED) gentoo-dev

2017-02-05 22:55:08 UTC

glsa request filed

Comment 15 Alex Xu (Hello71) 2017-02-17 13:46:04 UTC

please drop <net-libs/libvncserver-0.9.11-r1, thanks

Comment 16 Thomas Deutschmann (RETIRED) gentoo-dev

2017-02-17 14:31:17 UTC

Already done via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c329ef7d981dbb47dee4c1b45d7a98b7f60e38e

Comment 17 GLSAMaker/CVETool Bot gentoo-dev

2017-02-21 00:01:38 UTC

This issue was resolved and addressed in
 GLSA 201702-24 at https://security.gentoo.org/glsa/201702-24
by GLSA coordinator Thomas Deutschmann (whissi).