遠端主機受到 GLSA-202407-14 中所述的弱點影響 (TigerVNC：多個弱點)

    在 TigerVNC 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。

Tenable 已直接從 Gentoo Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 7 主機上安裝的套件受到 CESA-2020: 3875 公告中所提及的多個弱點影響。

  - tigervnc：因未正確使用 ZRLEDecoder 中的堆疊記憶體，而導致堆疊傳回後使用 (CVE-2019-15691)

  - tigervnc：存在從 CopyRectDecoder 觸發的堆積緩衝區溢位，這是由於值檢查不正確所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中存在堆積緩衝區溢位 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中存在堆積緩衝區溢位 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中存在緩衝區溢位 (CVE-2019-15695)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 1497 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 8 主机上安装的程序包受到 CESA-2020: 1497 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

远程主机受到 GLSA-202407-14 中所述漏洞的影响（TigerVNC：多个漏洞）

    在 TigerVNC 中发现多种漏洞。请检查下方引用的 CVE 标识符以了解详细信息。

Tenable 已直接从 Gentoo Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 7 主机上安装的程序包受到 CESA-2020: 3875 公告中提及的多个漏洞的影响。

  - tigervnc：存在堆栈返回后使用，这是未正确使用 ZRLEDecoder 中的堆栈内存所致 (CVE-2019-15691)

  - tigervnc：存在从 CopyRectDecoder 触发的堆缓冲区溢出，这是值检查不正确所致 (CVE-2019-15692)

  - tigervnc：TightDecoder: : FilterGradient 中的堆缓冲区溢出 (CVE-2019-15693)

  - tigervnc：DecodeManager: : decodeRect 中的堆缓冲区溢出 (CVE-2019-15694)

  - tigervnc：CMsgReader: : readSetCursor 中的堆栈缓冲区溢出 (CVE-2019-15695)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

This update for tigervnc provides the following fixes :

Security issues fixed :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Non-security issue fixed :

Make sure CN in generated certificate doesn't exceed 64 characters.
(bnc#1041847)

Change with-vnc-key.sh to generate TLS certificate using current hostname to keep it short. (bsc#1041847)

Disable MIT-SHM extension when running under user 'vnc'. (bsc#1053373)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tigervnc fixes the following issues :

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).

CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).

CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).

CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).

CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3875 advisory.

    [1.8.0-21]
    - Add upstream patch needed because of previous security fixes       Resolves: bz#1826822

    [1.8.0-20]
    - Fix stack buffer overflow in CMsgReader::readSetCursor       Resolves: bz#1791773

    - Fix heap buffer overflow in DecodeManager::decodeRect       Resolves: bz#1791768

    - Fix heap buffer overflow in TightDecoder::FilterGradient       Resolves: bz#1791763

    - Fix heap-based buffer overflow triggered from CopyRectDecoder       Resolves: bz#1791747

    - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder       Resolves: bz#1791759

    - Add option to fallback to empty port when the specified one is taken       Resolves: bz#1791996

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - tigervnc: Stack use-after-return due to incorrect usage     of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from     CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in     TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in     DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in     CMsgReader::readSetCursor (CVE-2019-15695)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3875 advisory.

  - tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder (CVE-2019-15691)

  - tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks     (CVE-2019-15692)

  - tigervnc: Heap buffer overflow in TightDecoder::FilterGradient (CVE-2019-15693)

  - tigervnc: Heap buffer overflow in DecodeManager::decodeRect (CVE-2019-15694)

  - tigervnc: Stack buffer overflow in CMsgReader::readSetCursor (CVE-2019-15695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tigervnc installed on the remote host is prior to 1.8.0-21.34. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1470 advisory.

  - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect     usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to     access stack variable, which has been already freed during the process of stack unwinding. Exploitation of     this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered     from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear to be exploitable via network connectivity.
    (CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via network connectivity. (CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially result into remote code execution. This attack appear     to be exploitable via network connectivity. (CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat.
    Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation     of this vulnerability could potentially result into remote code execution. This attack appear to be     exploitable via network connectivity. (CVE-2019-15695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     use-after-return, which occurs due to incorrect usage     of stack memory in ZRLEDecoder. If decoding routine     would throw an exception, ZRLEDecoder may try to access     stack variable, which has been already freed during the     process of stack unwinding. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15691)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow. Vulnerability could be triggered from     CopyRectDecoder due to incorrect value checks.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15692)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which occurs in     TightDecoder::FilterGradient. Exploitation of this     vulnerability could potentially result into remote code     execution. This attack appear to be exploitable via     network connectivity.(CVE-2019-15693)

  - TigerVNC version prior to 1.10.1 is vulnerable to heap     buffer overflow, which could be triggered from     DecodeManager::decodeRect. Vulnerability occurs due to     the signdness error in processing MemOutStream.
    Exploitation of this vulnerability could potentially     result into remote code execution. This attack appear     to be exploitable via network     connectivity.(CVE-2019-15694)

  - TigerVNC version prior to 1.10.1 is vulnerable to stack     buffer overflow, which could be triggered from     CMsgReader::readSetCursor. This vulnerability occurs     due to insufficient sanitization of PixelFormat. Since     remote attacker can choose offset from start of the     buffer to start writing his values, exploitation of     this vulnerability could potentially result into remote     code execution. This attack appear to be exploitable     via network connectivity.(CVE-2019-15695)

  - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in     TigerVNC before 1.11.0, viewers mishandle TLS     certificate exceptions. They store the certificates as     authorities, meaning that the owner of a certificate     could impersonate any server after a client had added     an exception.(CVE-2020-26117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
201916	GLSA-202407-14：TigerVNC：多個弱點	Nessus	Gentoo Local Security Checks	2024/7/5	2024/7/5	high
141600	CentOS 7：tigervnc (CESA-2020: 3875)	Nessus	CentOS Local Security Checks	2020/10/20	2024/10/9	high
135876	RHEL 8：tigervnc (RHSA-2020: 1497)	Nessus	Red Hat Local Security Checks	2020/4/22	2024/6/4	high
146003	CentOS 8：tigervnc (CESA-2020: 1497)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
201916	GLSA-202407-14：TigerVNC：多个漏洞	Nessus	Gentoo Local Security Checks	2024/7/5	2024/7/5	high
141600	CentOS 7：tigervnc (CESA-2020: 3875)	Nessus	CentOS Local Security Checks	2020/10/20	2024/10/9	high
133395	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0266-1)	Nessus	SuSE Local Security Checks	2020/1/31	2024/3/28	high
133201	SUSE SLES12 Security Update : tigervnc (SUSE-SU-2020:0159-1)	Nessus	SuSE Local Security Checks	2020/1/23	2024/3/29	high
141215	Oracle Linux 7 : tigervnc (ELSA-2020-3875)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/10/22	high
139988	EulerOS 2.0 SP8 : tigervnc (EulerOS-SA-2020-1885)	Nessus	Huawei Local Security Checks	2020/8/28	2024/2/22	high
141653	Scientific Linux Security Update : tigervnc on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
141028	RHEL 7 : tigervnc (RHSA-2020:3875)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/2/16	high
144989	Amazon Linux AMI : tigervnc (ALAS-2021-1470)	Nessus	Amazon Linux Local Security Checks	2021/1/14	2024/1/30	high
145143	EulerOS 2.0 SP3 : tigervnc (EulerOS-SA-2021-1127)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high