Описание
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| tightvnc | fixed | 1:1.3.9-9.1 | package | |
| tightvnc | fixed | 1:1.3.9-9deb10u1 | buster | package |
| tightvnc | fixed | 1:1.3.9-9+deb9u1 | stretch | package |
| italc | removed | package | ||
| libvncserver | unfixed | package |
Примечания
https://www.openwall.com/lists/oss-security/2018/12/10/5
https://github.com/sunweaver/libvncserver/commit/85d00057b5daf71675462c9b175d8cb2d47cd0e1
Non-issue in libvncserver's case: https://github.com/LibVNC/libvncserver/issues/359#issuecomment-599202068
EPSS
Связанные уязвимости
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
Уязвимость функции HandleZlibBPP реализации VNC с расширениями для оптимизации работы в условиях медленных каналов передачи данных Tightvnc, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
EPSS