Bug 1180848 - tigervnc requires rebuild after Dec-2014 xorg-x11-server CVEs
Summary: tigervnc requires rebuild after Dec-2014 xorg-x11-server CVEs
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-11 03:32 UTC by Yaakov Selkowitz
Modified: 2015-07-28 12:48 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2015-06-05 16:16:06 UTC
Embargoed:

Attachments (Terms of Use)

Description Yaakov Selkowitz 2015-01-11 03:32:57 UTC 
The Xvnc server (tigervnc-server) and VNC extension for the Xorg server (tigervnc-server-module) are built with xorg-x11-server-source, but have not been rebuilt since the numerous security issues announced in December 2014 (CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103).

Therefore, 1) tigervnc needs to be rebuilt for all supported branches in both Fedora and RHEL, and 2) something needs to be put in place that CVEs in xorg-x11-server also trigger notifications for tigervnc.
Comment 3 Tomas Hoger 2015-01-12 12:31:50 UTC 
(In reply to Yaakov Selkowitz from comment #0)
> 2) something needs to be put in place that CVEs in xorg-x11-server also
> trigger notifications for tigervnc.

X server issues do not get automatically handled as security for *vnc, as the X server there is not suid-root and hence no privilege escalation vector.
Comment 4 Kurt Seifried 2015-06-05 16:16:06 UTC 
Closed wontfix as per thogers comment.
Note You need to log in before you can comment on or make changes to this bug.