Bug 1180848

Summary:	tigervnc requires rebuild after Dec-2014 xorg-x11-server CVEs
Product:	[Other] Security Response	Reporter:	Yaakov Selkowitz <yselkowi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	jrusnack, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-06-05 16:16:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Yaakov Selkowitz 2015-01-11 03:32:57 UTC

The Xvnc server (tigervnc-server) and VNC extension for the Xorg server (tigervnc-server-module) are built with xorg-x11-server-source, but have not been rebuilt since the numerous security issues announced in December 2014 (CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103).

Therefore, 1) tigervnc needs to be rebuilt for all supported branches in both Fedora and RHEL, and 2) something needs to be put in place that CVEs in xorg-x11-server also trigger notifications for tigervnc.

Comment 3 Tomas Hoger 2015-01-12 12:31:50 UTC

(In reply to Yaakov Selkowitz from comment #0)
> 2) something needs to be put in place that CVEs in xorg-x11-server also
> trigger notifications for tigervnc.

X server issues do not get automatically handled as security for *vnc, as the X server there is not suid-root and hence no privilege escalation vector.

Comment 4 Kurt Seifried 2015-06-05 16:16:06 UTC

Closed wontfix as per thogers comment.