CVE-2019-15693

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Updated tigervnc packages fix security vulnerabilities:

The tigervnc package has been updated to version 1.10.1 to fix multiple unspecified security issues. These issues affect both the client and server and could theoretically allow an malicious peer to take control over the software on the other side. No working exploit is known at this time, and the issues require the peer to first be authenticated (CVE-2019-15691, CVE-2019-15692, CVE-2019-15693, CVE-2019-15694, CVE-2019-15695).

This update for tigervnc fixes the following issues:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the libXvnc-devel-1.10.1-17.1 package on the GA media of openSUSE Tumbleweed.

This update for tigervnc fixes the following issues:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

This update for tigervnc fixes the following issues:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

This update for tigervnc fixes the following issues:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

This update for tigervnc provides the following fixes:

Security issues fixed:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Non-security issue fixed:

• Make sure CN in generated certificate doesn't exceed 64 characters. (bnc#1041847)
• Change with-vnc-key.sh to generate TLS certificate using current hostname to keep it short. (bsc#1041847)
• Disable MIT-SHM extension when running under user 'vnc'. (bsc#1053373)

This update for tigervnc fixes the following issues:

• CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
• CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
• CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
• CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
• CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Other bugs fixed:

• Fix random connection freezes (bsc#1169952, bsc#1160249, bsc#1165680):