CVE-2014-6053

Updated libvncserver and remmina packages fix security vulnerabilities:

A malicious VNC server can trigger incorrect memory management handling by advertising a large screen size parameter to the VNC client. This would result in multiple memory corruptions and could allow remote code execution on the VNC client (CVE-2014-6051, CVE-2014-6052).

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054).

A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055).

The remmina package had been built with a bundled copy of libvncserver. It has been rebuilt against the system libvncserver library to resolve these issues.

This KDE 4 update provides an upgrade to the last stable version of KDE Applications and Development Platform for the 4.12 series, and updates Plasma Workspaces to 4.11.12.

This update fixes several security vulnerabilities

• KMail/KIO POP3 SSL MITM Flaw (CVE-2014-3494 - mga#13545)
• KAuth PID Reuse Flaw (CVE-2014-5033 - mga#13792)
• krfb: possible denial of service or code execution via integer overflow (CVE-2014-4607 - mga#13933)
• krfb: multiple security issues in libvncserver (mga#14205) (CVE-2014-6053, CVE-2014-6054, CVE-2014-6055)

and additional issues

• poxml is compiled without antlr (mga#12612)
• crashes in bluedevil (mga#12751, mga#13618, mga#13728)
• kdelibs file dialog isn't properly translated in pure Qt apps (mga#12982)
• kate: self-closing xml tag breaks indentation (mga#13275, bko#330174)
• krdc missing dependency on freerdp (mga#13292)
• lock screen: can't start a new session after playing around with buttons (mga#13300, bko#331761)
• kbreakout missing dependency on libkdegames-corebindings (mga#13531)
• meinproc4 doesn't substitute entity with fixed libxml2 (mga#13555, mga#13559, bko#335001)
• calligra-words missing dependency on soprano-plugin-redland (mga#12008)
• digikam can't export to flickr (mga#13778, bko#336835)

See the referenced buglists in KDE announcements for the complete list of fixes.

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054).

A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055).

The krfb package is built with a bundled copy of libvncserver.

Updated vino packages fix security vulnerabilities:

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer did not properly handle attempts to send a large amount of ClientCutText data, which allowed remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that was processed by using a single unchecked malloc (CVE-2014-6053).

An issue was discovered in LibVNCServer. rfbProcessClientNormalMessage() in rfbserver.c did not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets (CVE-2018-7225).

LibVNC contained a memory leak in VNC server code, which allowed an attacker to read stack memory and could be abused for information disclosure. Combined with another vulnerability, it could be used to leak stack memory and bypass ASLR. This attack appeared to be exploitable via network connectivity (CVE-2019-15681).

The bundled libvncserver code in vino has been patched to fix these issues.

The LibVNCServer package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.
• bsc#854151: Restrict the SSL cipher suite.

The LibVNCServer package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.
• bsc#854151: Restrict the SSL cipher suite.

The libvncserver package was updated to fix the following security issues:

• bsc#897031: fix several security issues:
  • CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.
  • CVE-2014-6052: Lack of malloc() return value checking on client side.
  • CVE-2014-6053: Server crash on a very large ClientCutText message.
  • CVE-2014-6054: Server crash when scaling factor is set to zero.
  • CVE-2014-6055: Multiple stack overflows in File Transfer feature.

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when being advertised large screen sizes by the server. If a user were tricked into connecting to a malicious server, an attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2014-6051, CVE-2014-6052)

Nicolas Ruff discovered that LibVNCServer incorrectly handled large ClientCutText messages. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6053)

Nicolas Ruff discovered that LibVNCServer incorrectly handled zero scaling factor values. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6054)

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory in the file transfer feature. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-6055)

Nicolas Ruff discovered that Vino incorrectly handled large ClientCutText messages. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2014-6053)

It was discovered that Vino incorrectly handled certain packet lengths. A remote attacker could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code. (CVE-2018-7225)

Pavel Cheremushkin discovered that an information disclosure vulnerability existed in Vino when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. (CVE-2019-15681)

It was discovered that Vino incorrectly handled region clipping. A remote attacker could possibly use this issue to cause Vino to crash, resulting in a denial of service. (CVE-2020-14397)

It was discovered that Vino incorrectly handled encodings. A remote attacker could use this issue to cause Vino to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)

Nicolas Ruff discovered that iTALC had buffer overflows, divide-by-zero errors and didn't check malloc return values. A remote attacker could use these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2014-6051, CVE-2014-6052, CVE-2014-6053, CVE-2014-6054, CVE-2014-6055)

Josef Gajdusek discovered that iTALC had heap-based buffer overflow vulnerabilities. A remote attacker could used these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2016-9941, CVE-2016-9942)

It was discovered that iTALC had an out-of-bounds write, multiple heap out-of-bounds writes, an infinite loop, improper initializations, and null pointer vulnerabilities. A remote attacker could used these issues to cause a denial of service or possibly execute arbitrary code. (CVE-2018-15127, CVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20023, CVE-2018-20024, CVE-2018-20748, CVE-2018-20749, CVE-2018-20750, CVE-2018-7225, CVE-2019-15681)