-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.1026
                       libvncserver security update
                               24 March 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           libvncserver
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 7
                   Red Hat Enterprise Linux WS/Desktop 7
                   Red Hat Enterprise Linux Server 8
                   Red Hat Enterprise Linux WS/Desktop 8
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-15690  

Reference:         ESB-2020.0944

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2020:0913
   https://access.redhat.com/errata/RHSA-2020:0920
   https://access.redhat.com/errata/RHSA-2020:0921

Comment: This bulletin contains three (3) Red Hat security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: libvncserver security update
Advisory ID:       RHSA-2020:0913-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0913
Issue date:        2020-03-23
CVE Names:         CVE-2019-15690 
=====================================================================

1. Summary:

An update for libvncserver is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

LibVNCServer is a C library that enables you to implement VNC server
functionality into own programs.

Security Fix(es):

* libvncserver: HandleCursorShape() integer overflow resulting in
heap-based buffer overflow (CVE-2019-15690)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1811948 - CVE-2019-15690 libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
libvncserver-0.9.9-14.el7_7.src.rpm

x86_64:
libvncserver-0.9.9-14.el7_7.i686.rpm
libvncserver-0.9.9-14.el7_7.x86_64.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm
libvncserver-devel-0.9.9-14.el7_7.i686.rpm
libvncserver-devel-0.9.9-14.el7_7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
libvncserver-0.9.9-14.el7_7.src.rpm

ppc64le:
libvncserver-0.9.9-14.el7_7.ppc64le.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.ppc64le.rpm

x86_64:
libvncserver-0.9.9-14.el7_7.i686.rpm
libvncserver-0.9.9-14.el7_7.x86_64.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64le:
libvncserver-debuginfo-0.9.9-14.el7_7.ppc64le.rpm
libvncserver-devel-0.9.9-14.el7_7.ppc64le.rpm

x86_64:
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm
libvncserver-devel-0.9.9-14.el7_7.i686.rpm
libvncserver-devel-0.9.9-14.el7_7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
libvncserver-0.9.9-14.el7_7.src.rpm

x86_64:
libvncserver-0.9.9-14.el7_7.i686.rpm
libvncserver-0.9.9-14.el7_7.x86_64.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:
libvncserver-debuginfo-0.9.9-14.el7_7.i686.rpm
libvncserver-debuginfo-0.9.9-14.el7_7.x86_64.rpm
libvncserver-devel-0.9.9-14.el7_7.i686.rpm
libvncserver-devel-0.9.9-14.el7_7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-15690
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXnh229zjgjWX9erEAQj40w//eoOSRsxr3nFhiQom/+qYiRbJtzi5q+nv
Lx4A4Vge0tYfbV2yQl9ggQ47Zmqidz1bHWrAHPKLZ7hK8u15smSEn4YThkhYl3QZ
7o1hwKfJdT4+x2WFcn0XwfR4VW8H/zPg8SAXoIpK/q6NGjd9OL39QDQPqFEgWLD3
iGN9FOQnWzjnWqk++L+Vwjca8avEVi1HubMv+RtGW1AelFE2D9+EutcgrGk27do2
l0utk3BV/V8BvhxcmL+I1dtNOb8rfo9F5WRxD3ppgMAt9ZroIpXxKGoNhDmBa/8z
+eBqdu4TIG6ElSAZ2kEC2PmrX3hnQaAv3rd9I+LhYgOeLVikNkuo3Y8gf8s4oEiM
9fYEUrjIWJn/n+rt4LZ0aKne3FwGxZZuKgUXIuaKSgo9TGg6g/qvvm/fQhddi0im
nznUpROdT84RJs8IP5c2lgWhmlvLUG7Mwj4sfW3uJaCjkA23G/gVsypckifpMOzT
kZ8WYQDmOKdvUI82GcTHYWolhS2J0BGZ4TCSioCgkoaeOYnGB23zofdP2omsIr8i
klNYNQda1hpQUNcis8hX5EKAxGzIYHVdx/PrtUeOvWmRARUzo70Mq2MCJZ1yL5EE
AbmZmGJfdHxR8wrJ0DTEmuty3oXYQI0maYBrZU1ISd+gsUB1kIQxAT9hR93A89Wc
C2mDoirErVY=
=FjHJ
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: libvncserver security update
Advisory ID:       RHSA-2020:0920-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0920
Issue date:        2020-03-23
CVE Names:         CVE-2019-15690 
=====================================================================

1. Summary:

An update for libvncserver is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - ppc64le, x86_64

3. Description:

LibVNCServer is a C library that enables you to implement VNC server
functionality into own programs.

Security Fix(es):

* libvncserver: HandleCursorShape() integer overflow resulting in
heap-based buffer overflow (CVE-2019-15690)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1811948 - CVE-2019-15690 libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
libvncserver-0.9.11-9.el8_1.2.src.rpm

ppc64le:
libvncserver-0.9.11-9.el8_1.2.ppc64le.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.ppc64le.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.ppc64le.rpm

x86_64:
libvncserver-0.9.11-9.el8_1.2.i686.rpm
libvncserver-0.9.11-9.el8_1.2.x86_64.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.i686.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.x86_64.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.i686.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

Source:
libvncserver-0.9.11-9.el8_1.2.src.rpm

aarch64:
libvncserver-0.9.11-9.el8_1.2.aarch64.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.aarch64.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.aarch64.rpm
libvncserver-devel-0.9.11-9.el8_1.2.aarch64.rpm

ppc64le:
libvncserver-debuginfo-0.9.11-9.el8_1.2.ppc64le.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.ppc64le.rpm
libvncserver-devel-0.9.11-9.el8_1.2.ppc64le.rpm

s390x:
libvncserver-0.9.11-9.el8_1.2.s390x.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.s390x.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.s390x.rpm
libvncserver-devel-0.9.11-9.el8_1.2.s390x.rpm

x86_64:
libvncserver-debuginfo-0.9.11-9.el8_1.2.i686.rpm
libvncserver-debuginfo-0.9.11-9.el8_1.2.x86_64.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.i686.rpm
libvncserver-debugsource-0.9.11-9.el8_1.2.x86_64.rpm
libvncserver-devel-0.9.11-9.el8_1.2.i686.rpm
libvncserver-devel-0.9.11-9.el8_1.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-15690
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXnh3xtzjgjWX9erEAQgEchAApwQozYXsote9d8EzWxA7o0rzzbAHpluv
/XyATPfyrncEmcOIWXHb3UMy+XBdXqK/XjuR8avkaAT0CU8M92IDCTVgEZhBN08k
JPRnTBcChR1DVMzhd8ZHoBZa6HFGh8x07PRc8LkX7WvqA4SXlHpbIb/mJiaOgF0x
o/ovgYohXIofYQHOGzBE1GGSqOlHIszIU+FYOyEvdeZgQp4hKtu8WTs9fo2lJE4V
CMDxHN67MLHXSVuA63k8TMW5XVN7cx/0JBSRjBhcBhWq5KScvoS2UWUgMbysIS1Z
PXeT0Sg9jFDdfOBGUtaAxX904YQc7KojDGyTRvNadU+Gf6oGge8lOJGbfgYRAZlj
CXVsPaezVXEoY67uhBfqtdqmIzrUX7eL+8lF4fPnsu9mH1tw8fVpMCoiCvNQDVzQ
0hY9fTexXuzsVFP84H+tiH67nWYllgxKuGbvUHBZxB7+xYE1ordo+oWuX4xR0AYU
O2riZ3G0HyR/c8FulmLSMv6BRMku4JqdKSEM6U9hjh3Wlbo3MO4cnWNqsi1Yfzi9
sWEnvjO2piQtEWLS3x8Djet/3eR1aKosbMUgxVHh27/ME7xbAiWwnsv2hYKa4KYE
fsUQ2VMHyngor2vV2cwXg44RkfBPjaFgxr+5lratVU8ZLoIF9SnxuLPGFauI2v/i
+ctQO+Aaa0Q=
=kFkB
- -----END PGP SIGNATURE-----

- --------------------------------------------------------------------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: libvncserver security update
Advisory ID:       RHSA-2020:0921-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0921
Issue date:        2020-03-23
CVE Names:         CVE-2019-15690 
=====================================================================

1. Summary:

An update for libvncserver is now available for Red Hat Enterprise Linux
8.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.0) - ppc64le, x86_64

3. Description:

LibVNCServer is a C library that enables you to implement VNC server
functionality into own programs.

Security Fix(es):

* libvncserver: HandleCursorShape() integer overflow resulting in
heap-based buffer overflow (CVE-2019-15690)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1811948 - CVE-2019-15690 libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.0):

Source:
libvncserver-0.9.11-9.el8_0.2.src.rpm

ppc64le:
libvncserver-0.9.11-9.el8_0.2.ppc64le.rpm
libvncserver-debuginfo-0.9.11-9.el8_0.2.ppc64le.rpm
libvncserver-debugsource-0.9.11-9.el8_0.2.ppc64le.rpm

x86_64:
libvncserver-0.9.11-9.el8_0.2.i686.rpm
libvncserver-0.9.11-9.el8_0.2.x86_64.rpm
libvncserver-debuginfo-0.9.11-9.el8_0.2.i686.rpm
libvncserver-debuginfo-0.9.11-9.el8_0.2.x86_64.rpm
libvncserver-debugsource-0.9.11-9.el8_0.2.i686.rpm
libvncserver-debugsource-0.9.11-9.el8_0.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-15690
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXnh0utzjgjWX9erEAQgrfBAAgmqvt5Bji3RNYfSaGCZVirVw939ivw1n
MYmdiqzDXl+5pYJws0+LglP+XuLRd/8AspaB41WpPV/2g/0D9SrGUnDadV0xp62Y
3xmnQsC2UvytV868uTSHLnJ18T/UnisV0YLuJwSllRhFIoU+N6ewU07as9QiDLFe
nxfTgGKd/o5s+sXQU+D3hkBQLJ69IfaTusYeBQptX3C8I/DXY8RIc3VtuA3NFVca
yUGgqf0TMYE8er6aV94VQTpmZPErl5YCkdDmy2QnMynt9pXR3zm27a9KX30yiMc/
YawYiCmGzsoK4iKQ5Dp7Zow9evefYdQBHe5pBwDp8E36VTcVla1eGrDxtaubJGfh
lHCu01lkR+sDVRHjEKoa/2QWPdYG6NmI4+FgTACpGj+QN+Nj0n42B9IA9bfpMMf1
DDV004jKGMSpjFISsL1UryTTSLu/0M1F2L6FU+OFC2SO2RWY6Gtx9/zjh+siGFMt
IzRZnZDJ4n0ITYLGnkQH5JBAjCVpq6Va74WqbPl3kh7oGNmDX9OS+WlUmPt+F81N
1Hm9wHuFmiGoD1Pacl+Og1ev5WWdYn0+J6pXmCqcqW4Y9Ova9s/Lc0JIq2Z5mowr
eFzkct3NcSaKVVhvpZ2sj/1NSWzdvIj1wW3g0q2xp4JTRzuQ/u6qyA/gb4IJ/tDr
bCH7zplk/og=
=X1nX
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXnlmpmaOgq3Tt24GAQgmEg/+KGPAJmJ3Zr+SV/VGJ+FAKTVj4zml4/kh
ZTyTGBAsEa3fVKQhN+HzxqqjF3Kw58Mq2uC1AAAQukkkEbqCt4X+TKNZX6r0ZU4j
JM01yHLxbVR8AozlRJE/likwPVxOCiLEqQXmPuo3cFt4pfcccGS7KrUUvJREVOLt
iBMkhIhQdfWa97hbRucSu9xycFUjXKsRdRksc0FxKO1m1nM4uoT8nVEYRygM4Wpb
3IgfPuK08s3lM1QdE4Jv8sHB/bWMFuxtdSO7NiJJ5cOg9ehZZdxYIGLEJ9wpHxAc
RzC7jrADPSYnR5REukqdQJVR+swxIA8yRxYmYFSI3mh/lCk1EIhlY8gujnFJuDMz
LyTBKRupa/EPN9c2wFjDbm3ulUtjfk5SLY8aSo0S2MpA6vZf33b2AIqT5/Q5oV3j
glGEJlbmwHD0Skj80Vf7Fw6gjsK4XyVz6eg+kxOg1nbC4H437iwqutCykv/rQ4sU
tz1h3bYe1xDqQsc2XBjF4hVlwTyrNEH0ObSuUuo/Ye9G8tNEre2ERWhfBC0h8Ynb
mI4iLz5wvfOxdZr9g7LYfn3nOkg4Vwsm/I2CK5Zv3cj6Ch6CGS2oRmkadGnYhkjD
+Br9vYKwLe05XwbPta7uYihKdRtpsGo60oWpiP/L4pFL+T3IcZTtYTsIv9mxDDXx
7HO/UifrZRk=
=Vc8e
-----END PGP SIGNATURE-----