An integer overflow within the HandleCursorShape() function in libvncclient/cursor.c can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently sending cursor shapes with specially crafted dimensions.
Created libvncserver tracking bugs for this issue: Affects: epel-7 [bug 1811951] Affects: fedora-all [bug 1811950]
Researcher Reference: https://www.openwall.com/lists/oss-security/2019/12/20/2
Patch: https://github.com/LibVNC/libvncserver/commit/54220248886b5001fbbb9fa73c4e1a2cb9413fed
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:0921 https://access.redhat.com/errata/RHSA-2020:0921
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0913 https://access.redhat.com/errata/RHSA-2020:0913
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:0920 https://access.redhat.com/errata/RHSA-2020:0920
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-15690
*** Bug 1829870 has been marked as a duplicate of this bug. ***
Mitigation: Libvncserver should not be used to connect to untrusted server.