Bug 1144288 (CVE-2014-6052)

Summary:	CVE-2014-6052 libvncserver: NULL pointer dereference flaw in framebuffer setup
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alekcejk, carnil, chazlett, jgrulich, jreznik, jrusnack, kevin, ltinkl, negativo17, pahan, ppisar, rdieter, rnovacek, security-response-team, sisharma, smparrish, than, twaugh, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-11 22:33:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1145878, 1145879, 1145880, 1145883, 1157668, 1157669, 1157670, 1157671
Bug Blocks:	1144297

Description Murray McAllister 2014-09-19 07:35:47 UTC

A NULL pointer dereference flaw was reported in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a client to crash.

Upstream commit:

https://github.com/newsoft/libvncserver/commit/85a778c0e45e87e35ee7199f1f25020648e8b812

Comment 1 Murray McAllister 2014-09-24 04:19:39 UTC

Acknowledgements:

Red Hat would like to thank oCERT for reporting this issue. oCERT acknowledges Nicolas RUFF as the original reporter.

Comment 2 Murray McAllister 2014-09-24 04:21:01 UTC

Public now:

http://seclists.org/oss-sec/2014/q3/639

Comment 3 Murray McAllister 2014-09-24 04:29:43 UTC

Created libvncserver tracking bugs for this issue:

Affects: fedora-all [bug 1145878]
Affects: epel-5 [bug 1145879]
Affects: epel-7 [bug 1145880]

Comment 4 Murray McAllister 2014-09-24 04:48:39 UTC

Created krfb tracking bugs for this issue:

Affects: fedora-all [bug 1145883]

Comment 5 Murray McAllister 2014-09-24 04:51:07 UTC

krfb advisory:

http://www.kde.org/info/security/advisory-20140923-1.txt

Comment 8 Fedora Update System 2014-09-29 04:06:32 UTC

libvncserver-0.9.10-0.6.20140718git9453be42.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-10-01 04:23:28 UTC

libvncserver-0.9.10-0.6.20140718git9453be42.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-10-04 03:25:02 UTC

libvncserver-0.9.10-0.6.20140718git9453be42.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-10-08 19:11:25 UTC

krfb-4.11.5-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-10-13 21:38:33 UTC

libvncserver-0.9.10-0.6.20140718git9453be42.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Martin Prpič 2014-11-10 08:58:04 UTC

IssueDescription:

A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash.

Comment 16 errata-xmlrpc 2014-11-11 18:25:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:1826 https://rhn.redhat.com/errata/RHSA-2014-1826.html