ALT-PU-2026-5511

Низкий

ALT-PU-2026-5511: package libvncserver update to version 0.9.15-alt1

Источник

errata.altlinux.org

Дата публикации

03.04.2026

Дата обновления

03.04.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades libvncserver to version 0.9.15-alt1.

Устраненные уязвимости2

CVE-2026-32853

Высокий 8.1

Дата публикации: 24.03.2026

CWE-125

LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.

CVSS 3.1

Высокий 8.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

Ссылки

CVE-2026-32853 https://nvd.nist.gov/vuln/detail/CVE-2026-32853

Ссылки1

ALT-PU-2026-5511 https://errata.altlinux.org/ALT-PU-2026-5511

Связанные уязвимости

openSUSE-SU-2026:20552-1

suse-cvrf

7 месяцев назад

Security update for LibVNCServer

SUSE-SU-2026:1174-1

suse-cvrf

7 месяцев назад

Security update for LibVNCServer

SUSE-SU-2026:1173-1

suse-cvrf

7 месяцев назад

Security update for LibVNCServer

SUSE-SU-2026:1124-1

suse-cvrf

8 месяцев назад

Security update for LibVNCServer

CVE-2026-32854

CVSS3: 7.5

ubuntu

8 месяцев назад

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.