USN-4547-2: SSVNC vulnerabilities

28 September 2020

Several security issues were fixed in SSVNC.

Releases

Packages

  • ssvnc - Enhanced TightVNC viewer with SSL/SSH tunnel helper

Details

It was discovered that the LibVNCClient vendored in SSVNC incorrectly handled
certain packet lengths. A remote attacker could possibly use this issue to
obtain sensitive information, cause a denial of service, or execute arbitrary
code. (CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-2024)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

In general, a standard system update will make all the necessary changes.

Related notices

  • USN-3877-1: libvncserver1, libvncclient1, libvncserver0, libvncserver
  • USN-4547-1: libitalccore, italc, italc-master, italc-client
  • USN-4587-1: libitalccore, italc, italc-master, italc-client