USN-4547-2: SSVNC vulnerabilities
28 September 2020
Several security issues were fixed in SSVNC.
Releases
Packages
- ssvnc - Enhanced TightVNC viewer with SSL/SSH tunnel helper
Details
It was discovered that the LibVNCClient vendored in SSVNC incorrectly handled
certain packet lengths. A remote attacker could possibly use this issue to
obtain sensitive information, cause a denial of service, or execute arbitrary
code. (CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-2024)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-3877-1: libvncserver0, libvncserver-config, linuxvnc, libvncclient1, libvncserver1, libvncserver, libvncserver-dev
- USN-4547-1: italc, libitalccore, italc-master, italc-client
- USN-4587-1: italc-management-console, italc-master, italc-client, italc, libitalccore