Bug 1852356 (CVE-2017-18922) - CVE-2017-18922 libvncserver: websocket decoding buffer overflow
Summary: CVE-2017-18922 libvncserver: websocket decoding buffer overflow
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-18922
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1852505 1852506 1852507 1852508 1852509 1852510 1852511
Blocks: 1849880
TreeView+ depends on / blocked
 
Reported: 2020-06-30 08:54 UTC by Stefan Cornelius
Modified: 2020-09-01 14:53 UTC (History)
5 users (show)

Fixed In Version: libvncserver 0.9.12
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libvncserver. A heap-based buffer overflow within the websocket decoding functionality is possible, which can lead to exploitation by a malicious attacker to overwrite a function pointer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-08-03 19:27:45 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3281 0 None None None 2020-08-03 13:45:23 UTC
Red Hat Product Errata RHSA-2020:3385 0 None None None 2020-08-10 14:17:24 UTC
Red Hat Product Errata RHSA-2020:3456 0 None None None 2020-08-17 13:13:51 UTC
Red Hat Product Errata RHSA-2020:3588 0 None None None 2020-09-01 14:53:48 UTC

Description Stefan Cornelius 2020-06-30 08:54:59 UTC 
libvncserver container a heap-based buffer overflow within the websocket decoding functionality, which can be exploited by a malicious attacker to overwrite a function pointer.

Patch:
https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433
Comment 3 Stefan Cornelius 2020-06-30 14:56:05 UTC 
Created libvncserver tracking bugs for this issue:

Affects: fedora-all [bug 1852511]
Comment 13 errata-xmlrpc 2020-08-03 13:45:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3281 https://access.redhat.com/errata/RHSA-2020:3281
Comment 14 Product Security DevOps Team 2020-08-03 19:27:45 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-18922
Comment 15 errata-xmlrpc 2020-08-10 14:17:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3385 https://access.redhat.com/errata/RHSA-2020:3385
Comment 16 errata-xmlrpc 2020-08-17 13:13:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3456 https://access.redhat.com/errata/RHSA-2020:3456
Comment 17 errata-xmlrpc 2020-09-01 14:53:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3588 https://access.redhat.com/errata/RHSA-2020:3588
Note You need to log in before you can comment on or make changes to this bug.