[USN-4547-2] SSVNC vulnerabilities
Mike Salvatore
mike.salvatore at canonical.com
Mon Sep 28 20:04:25 UTC 2020
==========================================================================
Ubuntu Security Notice USN-4547-2
September 28, 2020
ssvnc vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in SSVNC.
Software Description:
- ssvnc: Enhanced TightVNC viewer with SSL/SSH tunnel helper
Details:
It was discovered that the LibVNCClient vendored in SSVNC incorrectly handled
certain packet lengths. A remote attacker could possibly use this issue to
obtain sensitive information, cause a denial of service, or execute arbitrary
code. (CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-2024)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
ssvnc 1.0.29-2+deb8u1build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4547-2
https://usn.ubuntu.com/4547-1
CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20024
Package Information:
https://launchpad.net/ubuntu/+source/ssvnc/1.0.29-2+deb8u1build0.16.04.1
More information about the ubuntu-security-announce
mailing list