Red Hat Security Advisory

RHSA-2020:3875

tigervnc security and bug fix update

Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) tigervnc-1.8.0-21.el7, tigervnc-icons-1.8.0-21.el7, tigervnc-license-1.8.0-21.el7 +2
Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.8.0-21.el7, tigervnc-server-module-1.8.0-21.el7
Red Hat Enterprise Linux ComputeNode (v. 7) tigervnc-1.8.0-21.el7, tigervnc-license-1.8.0-21.el7, tigervnc-server-minimal-1.8.0-21.el7
Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.8.0-21.el7, tigervnc-icons-1.8.0-21.el7, tigervnc-server-1.8.0-21.el7 +2
Red Hat Enterprise Linux Server (v. 7) tigervnc-1.8.0-21.el7, tigervnc-icons-1.8.0-21.el7, tigervnc-license-1.8.0-21.el7 +2
Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.8.0-21.el7, tigervnc-server-module-1.8.0-21.el7
Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.8.0-21.el7, tigervnc-icons-1.8.0-21.el7, tigervnc-license-1.8.0-21.el7 +2
Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.8.0-21.el7, tigervnc-server-module-1.8.0-21.el7

TI-2019-11779 CVE-2019-15695 · GHSA-25ff-c5j2-v9ch

LOW 39

TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04485 Published 2019-12-26 Partial fix CWE-121

TI-2019-11778 CVE-2019-15694 · GHSA-mm3v-7wx3-vx47

LOW 39

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04485 Published 2019-12-26 Partial fix CWE-122

TI-2019-11777 CVE-2019-15693 · GHSA-xv8c-xf4m-4698

LOW 39

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04277 Published 2019-12-26 Partial fix CWE-122

TI-2019-11776 CVE-2019-15692 · GHSA-hc53-6v72-2h55

LOW 39

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04773 Published 2019-12-26 Partial fix CWE-122

TI-2019-11775 CVE-2019-15691 · GHSA-vmc8-ggh9-8p8j

LOW 39

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04719 Published 2019-12-26 Partial fix CWE-825