https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-031-libvnc-infinite-loop/ # CVE-2018-20021 https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/ # CVE-2018-20020 https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-029-libvnc-multiple-heap-out-of-bound-vulnerabilities/ # CVE-2018-20019 https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-032-libvnc-multiple-memory-leaks/ #CVE-2018-20022 https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-033-libvnc-memory-leak/ # CVE-2018-20023 https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-034-libvnc-null-pointer-dereference/ # CVE-2018-20024 @maintainer(s): Milestone for LibVNC due for 0.9.12. Proceed as needed. Gentoo Security Padawan (domhnall)
While working on x11vnc, a related projectm I ended up preparing a version bump: https://github.com/swegener/gentoo/commit/1338b4e70fd9e2d6bdbf0f9172c6cfef5d0d6a5e I haven't pushed it yet, just in case Alex is already working on it.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4fbd9dd57d76b333b4c75791b1590f5ee09119f1 commit 4fbd9dd57d76b333b4c75791b1590f5ee09119f1 Author: Sven Wegener <swegener@gentoo.org> AuthorDate: 2019-01-15 21:40:20 +0000 Commit: Sven Wegener <swegener@gentoo.org> CommitDate: 2019-01-17 21:21:30 +0000 net-libs/libvncserver: Version bump, security bug #659560 and #673508 Bug: https://bugs.gentoo.org/659560 Bug: https://bugs.gentoo.org/673508 Closes: https://bugs.gentoo.org/435326 Closes: https://bugs.gentoo.org/675046 Signed-off-by: Sven Wegener <swegener@gentoo.org> Package-Manager: Portage-2.3.51, Repoman-2.3.11 net-libs/libvncserver/Manifest | 1 + .../files/libvncserver-0.9.12-cmake-libdir.patch | 22 +++++++ net-libs/libvncserver/libvncserver-0.9.12.ebuild | 72 ++++++++++++++++++++++ 3 files changed, 95 insertions(+)
Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.
Cleanup done in 61a66db5451e859c3cc01853ba5a5737c2157147
This issue was resolved and addressed in GLSA 201908-05 at https://security.gentoo.org/glsa/201908-05 by GLSA coordinator Aaron Bauman (b-man).
Freeing aliases for tracker creation.
