Format: 1.8
Date: Mon, 13 Jul 2020 16:01:32 -0400
Source: libvncserver
Binary: libvncclient1 libvncserver1 libvncserver-dev libvncserver-config libvncclient1-dbg libvncserver1-dbg
Architecture: i386
Version: 0.9.11+dfsg-1ubuntu1.3
Distribution: bionic
Urgency: medium
Maintainer: Launchpad Build Daemon <buildd@lgw01-amd64-060.buildd>
Changed-By: Avital Ostromich <avital.ostromich@canonical.com>
Description:
 libvncclient1 - API to write one's own VNC server - client library
 libvncclient1-dbg - debugging symbols for libvncclient
 libvncserver-config - API to write one's own VNC server - library utility
 libvncserver-dev - API to write one's own VNC server - development files
 libvncserver1 - API to write one's own VNC server
 libvncserver1-dbg - debugging symbols for libvncserver
Changes:
 libvncserver (0.9.11+dfsg-1ubuntu1.3) bionic-security; urgency=medium
 .
   * SECURITY UPDATE: buffer overflow via a long socket filename
     - debian/patches/CVE-2019-20839.patch: Error out if the unix socket name
       would overflow in libvncclient/sockets.c.
     - CVE-2019-20839
   * SECURITY UPDATE: unaligned accesses in hybiReadAndDecode can lead to a
     crash
     - debian/patches/CVE-2019-20840.patch: Ensure a proper stack alignment in
       libvncserver/websockets.c.
     - CVE-2019-20840
   * SECURITY UPDATE: NULL pointer dereference in region clipping span routine
     - debian/patches/CVE-2020-14397.patch: Add NULL pointer dereference checks
       to libvncserver/rfbregion.c.
     - CVE-2020-14397
   * SECURITY UPDATE: infinite loop due to improperly closed TCP connection
     - debian/patches/CVE-2020-14398.patch: Close the connection after a certain
       number of retries in libvncclient/sockets.c.
     - CVE-2020-14398
   * SECURITY UPDATE: byte-aligned data is accessed through uint32_t pointers
     - debian/patches/CVE-2020-14399.patch: Ensure a proper stack alignment in
       libvncclient/rfbproto.c.
     - CVE-2020-14399
   * SECURITY UPDATE: byte-aligned data is accessed through uint16_t pointers
     - debian/patches/CVE-2020-14400.patch: Ensure a proper stack alignment in
       libvncserver/translate.c.
     - CVE-2020-14400
   * SECURITY UPDATE: integer overflow in bitwise operation on pixel_value
     - debian/patches/CVE-2020-14401.patch: Cast variable to 64 bit before
       performing bitwise operation.
     - CVE-2020-14401
   * SECURITY UPDATE: out-of-bounds access via encodings
     - debian/patches/CVE-2020-14402_CVE-2020-14403_CVE-2020-14404.patch:
       Check bounds before accessing array value in libvncserver/corre.c,
       libvncserver/hextile.c and libvncserver/rre.c
     - CVE-2020-14402
     - CVE-2020-14403
     - CVE-2020-14404
   * SECURITY UPDATE: unchecked TextChat allocation size
     - debian/patches/CVE-2020-14405.patch: Limit max TextChat size in
       libvncclient/rfbproto.c.
     - CVE-2020-14405
Checksums-Sha1:
 ce2e5acabf55871c844476b06222384c78b2bb80 118104 libvncclient1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 8e914605c5aed3dd72d840f9226c2ef4acdbf2c4 58492 libvncclient1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 16ea1889578bf8f41a3a1dd87fc7ae2e69c15955 20628 libvncserver-config_0.9.11+dfsg-1ubuntu1.3_i386.deb
 27e4ab225654c950969a173bfa82c5ad33cc0eb0 223628 libvncserver-dev_0.9.11+dfsg-1ubuntu1.3_i386.deb
 fae127f60dc0def407d87074e50a1e72d37a85b5 327324 libvncserver1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 b3e0e645b9fb68056d2ea447aaa211e3ce01368f 129736 libvncserver1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 c3b24b49eea5bbb84d708d8b9263e84f2e39a7cc 7757 libvncserver_0.9.11+dfsg-1ubuntu1.3_i386.buildinfo
Checksums-Sha256:
 12a50b21a9ac4ecdb4f8b3ad7e841d30e3cd44fa24df1361ca6242ed674d6a0b 118104 libvncclient1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 800cd182118801e5bb12fa2bf7d39e96509fe8864a74c877c0b5797e99b9396c 58492 libvncclient1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 92ea42cec3d0c09134cd5d38dba85acf5f37ca6579a96f21375ba91d675ab5c5 20628 libvncserver-config_0.9.11+dfsg-1ubuntu1.3_i386.deb
 185733d9183fd638b374925bb8ef5e72affd94624c3f546700854354f25f0880 223628 libvncserver-dev_0.9.11+dfsg-1ubuntu1.3_i386.deb
 cea0feb3432e9e08ad684472b308136aa748767dedcfcb4e1643c387f9bddd4c 327324 libvncserver1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 e56b47ae1520da6965243c5394a82a47b218610b0a8e52f2b9972db2d2d0d9ce 129736 libvncserver1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 b8a1be051578a99b9844e473a9669f2edd9883ba0e39e06adef763feb531c79c 7757 libvncserver_0.9.11+dfsg-1ubuntu1.3_i386.buildinfo
Files:
 028f21511c4d63d20f29619d29ef1035 118104 debug extra libvncclient1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 f413b09d96033faf4359b09e1040db4a 58492 libs optional libvncclient1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 597221a41b47a1aac1100e4f557c17f3 20628 libdevel optional libvncserver-config_0.9.11+dfsg-1ubuntu1.3_i386.deb
 888adf529635b716a91f186726e1cb31 223628 libdevel optional libvncserver-dev_0.9.11+dfsg-1ubuntu1.3_i386.deb
 b8f2adf3ac5492b041de679991e3ba1a 327324 debug extra libvncserver1-dbg_0.9.11+dfsg-1ubuntu1.3_i386.deb
 2947d96d92835882249eae5449bf2dd3 129736 libs optional libvncserver1_0.9.11+dfsg-1ubuntu1.3_i386.deb
 0b0ecd6a07fe0320856bea220f44599c 7757 libs optional libvncserver_0.9.11+dfsg-1ubuntu1.3_i386.buildinfo
Original-Maintainer: Peter Spiess-Knafl <dev@spiessknafl.at>