CVE-2014-6052

Updated libvncserver and remmina packages fix security vulnerabilities:

A malicious VNC server can trigger incorrect memory management handling by advertising a large screen size parameter to the VNC client. This would result in multiple memory corruptions and could allow remote code execution on the VNC client (CVE-2014-6051, CVE-2014-6052).

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054).

A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055).

The remmina package had been built with a bundled copy of libvncserver. It has been rebuilt against the system libvncserver library to resolve these issues.

The LibVNCServer package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.
• bsc#854151: Restrict the SSL cipher suite.

The LibVNCServer package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.
• bsc#854151: Restrict the SSL cipher suite.

The libvncserver package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.

The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when being advertised large screen sizes by the server. If a user were tricked into connecting to a malicious server, an attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2014-6051, CVE-2014-6052)

Nicolas Ruff discovered that LibVNCServer incorrectly handled large ClientCutText messages. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6053)

Nicolas Ruff discovered that LibVNCServer incorrectly handled zero scaling factor values. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6054)

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory in the file transfer feature. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-6055)

Nicolas Ruff discovered that iTALC had buffer overflows, divide-by-zero errors and didn't check malloc return values. A remote attacker could use these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2014-6051, CVE-2014-6052, CVE-2014-6053, CVE-2014-6054, CVE-2014-6055)

Josef Gajdusek discovered that iTALC had heap-based buffer overflow vulnerabilities. A remote attacker could used these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2016-9941, CVE-2016-9942)

It was discovered that iTALC had an out-of-bounds write, multiple heap out-of-bounds writes, an infinite loop, improper initializations, and null pointer vulnerabilities. A remote attacker could used these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2018-15127, CVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20023, CVE-2018-20024, CVE-2018-20748, CVE-2018-20749, CVE-2018-20750, CVE-2018-7225, CVE-2019-15681)