USN-4573-1: Vino vulnerabilities

07 October 2020

Several security issues were fixed in Vino.

Releases

Packages

  • vino - VNC server for GNOME

Details

Nicolas Ruff discovered that Vino incorrectly handled large ClientCutText
messages. A remote attacker could use this issue to cause the server to
crash, resulting in a denial of service. (CVE-2014-6053)

It was discovered that Vino incorrectly handled certain packet lengths. A
remote attacker could possibly use this issue to obtain sensitive
information, cause a denial of service, or execute arbitrary code.
(CVE-2018-7225)

Pavel Cheremushkin discovered that an information disclosure vulnerability
existed in Vino when sending a ServerCutText message. An attacker could
possibly use this issue to expose sensitive information. (CVE-2019-15681)

It was discovered that Vino incorrectly handled region clipping. A remote
attacker could possibly use this issue to cause Vino to crash, resulting in
a denial of service. (CVE-2020-14397)

It was discovered that Vino incorrectly handled encodings. A remote
attacker could use this issue to cause Vino to crash, resulting in a denial
of service, or possibly execute arbitrary code. (CVE-2020-14402,
CVE-2020-14403, CVE-2020-14404)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04

After a standard system update you need to restart your session to make all
the necessary changes.

Related notices

  • USN-4407-1: libvncserver1, libvncclient1, libvncserver
  • USN-3618-1: libvncserver1, libvncclient1, libvncserver, libvncserver0
  • USN-4434-1: libvncserver1, libvncclient1, libvncserver
  • USN-2365-1: libvncserver0, libvncserver
  • USN-4547-1: italc-master, italc-client, italc, libitalccore
  • USN-4587-1: italc-master, italc-client, italc, libitalccore