USN-4522-1: noVNC vulnerability
21 September 2020
noVNC could be made to execute arbitrary code.
- novnc - HTML5 VNC client - daemon and programs
It was discovered that noVNC did not properly manage certain messages,
resulting in the remote VNC server injecting arbitrary HTML into the
noVNC web page. An attacker could use this issue to conduct cross-site
scripting (XSS) attacks. (CVE-2017-18635)
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.