Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-7225 →
DEBIAN-CVE-2018-7225
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to ac...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
libvncserver
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.1"}]}]
Debian:13
libvncserver
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.1"}]}]
Debian:14
libvncserver
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.1"}]}]
Debian:12
tightvnc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.9-9.1"}]}]
Debian:13
tightvnc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.9-9.1"}]}]
Debian:14
tightvnc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.9-9.1"}]}]
Debian:12
vino
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-6"}]}]
Références
- advisory security-tracker.debian.org