USN-3171-1: LibVNCServer vulnerabilities
Josef Gajdusek discovered that the LibVNCServer client library incorrectly handled certain FrameBufferUpdate messages. If a user were tricked into connecting to a malicious server, an attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2016-9941, CVE-2016-9942)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libvncclient1to a version that resolves this vulnerability.Fixed in 0.9.10+dfsg-3ubuntu0.16.10.1 - Upgrade
Upgrade
ubuntu/libvncserver1to a version that resolves this vulnerability.Fixed in 0.9.10+dfsg-3ubuntu0.16.10.1 - Upgrade
Upgrade
ubuntu/libvncclient1to a version that resolves this vulnerability.Fixed in 0.9.10+dfsg-3ubuntu0.16.04.1 - Upgrade
Upgrade
ubuntu/libvncserver1to a version that resolves this vulnerability.Fixed in 0.9.10+dfsg-3ubuntu0.16.04.1 - Upgrade
Upgrade
ubuntu/libvncserver0to a version that resolves this vulnerability.Fixed in 0.9.9+dfsg-1ubuntu1.2 - Upgrade
Upgrade
ubuntu/libvncserver0to a version that resolves this vulnerability.Fixed in 0.9.8.2-2ubuntu1.2 - Upgrade
Upgrade
LibVNCServerto a version that resolves this vulnerability.Patch USN-3171-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2016-9941.
What is the severity of CVE-2016-9941?
The severity of CVE-2016-9941 is not provided in the advisory.
How does the vulnerability CVE-2016-9941 affect LibVNCServer?
The vulnerability CVE-2016-9941 affects the LibVNCServer client library.
How can an attacker exploit CVE-2016-9941?
An attacker can exploit CVE-2016-9941 by tricking a user into connecting to a malicious server.
Is there a fix available for CVE-2016-9941?
Yes, a fix is available for CVE-2016-9941. Users should update to version 0.9.10+dfsg-3ubuntu0.16.10.1 of libvncclient1 and libvncserver1.