Security update for tigervnc

Announcement ID:	SUSE-SU-2017:1094-1
Rating:	moderate
References:	bsc#1024929 bsc#1026833 bsc#1031045 bsc#1031875 bsc#1031877 bsc#1031879 bsc#1031886 bsc#1032272 bsc#1032880
Cross-References:	CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396
CVSS scores:	CVE-2017-7392 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-7392 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-7393 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2017-7393 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2017-7394 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-7394 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-7395 ( SUSE ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2017-7395 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2017-7396 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-7396 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2

An update that solves five vulnerabilities and has four security fixes can now be installed.

Description:

This update for tigervnc provides the several fixes.

These security issues were fixed:

• CVE-2017-7392, CVE-2017-7396: Client can cause leak in VNC server (bsc#1031886)
• CVE-2017-7395: Authenticated VNC client can crash VNC server (bsc#1031877)
• CVE-2017-7394: Client can crash or block VNC server (bsc#1031879)
• CVE-2017-7393: Authenticated client can cause double free in VNC server (bsc#1031875)
• Prevent buffer overflow in VNC client, allowing for crashing the client (bnc#1032880)

These non-security issues were fixed:

• Prevent client disconnection caused by invalid cursor manipulation. (bsc#1024929, bsc#1031045)
• Readd index.vnc. (bsc#1026833)
• Crop operations to visible screen. (bnc#1032272)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP2
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-635=1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
  zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-635=1
• SUSE Linux Enterprise High Performance Computing 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-635=1
• SUSE Linux Enterprise Server 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-635=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-635=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
  • libXvnc1-debuginfo-1.6.0-18.11.1
  • tigervnc-debugsource-1.6.0-18.11.1
  • libXvnc1-1.6.0-18.11.1
  • xorg-x11-Xvnc-1.6.0-18.11.1
  • tigervnc-debuginfo-1.6.0-18.11.1
  • xorg-x11-Xvnc-debuginfo-1.6.0-18.11.1
  • tigervnc-1.6.0-18.11.1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
  • libXvnc1-debuginfo-1.6.0-18.11.1
  • tigervnc-debugsource-1.6.0-18.11.1
  • libXvnc1-1.6.0-18.11.1
  • xorg-x11-Xvnc-1.6.0-18.11.1
  • tigervnc-debuginfo-1.6.0-18.11.1
  • xorg-x11-Xvnc-debuginfo-1.6.0-18.11.1
  • tigervnc-1.6.0-18.11.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
  • libXvnc1-debuginfo-1.6.0-18.11.1
  • tigervnc-debugsource-1.6.0-18.11.1
  • libXvnc1-1.6.0-18.11.1
  • xorg-x11-Xvnc-1.6.0-18.11.1
  • tigervnc-debuginfo-1.6.0-18.11.1
  • xorg-x11-Xvnc-debuginfo-1.6.0-18.11.1
  • tigervnc-1.6.0-18.11.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
  • libXvnc1-debuginfo-1.6.0-18.11.1
  • tigervnc-debugsource-1.6.0-18.11.1
  • libXvnc1-1.6.0-18.11.1
  • xorg-x11-Xvnc-1.6.0-18.11.1
  • tigervnc-debuginfo-1.6.0-18.11.1
  • xorg-x11-Xvnc-debuginfo-1.6.0-18.11.1
  • tigervnc-1.6.0-18.11.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • libXvnc1-debuginfo-1.6.0-18.11.1
  • tigervnc-debugsource-1.6.0-18.11.1
  • libXvnc1-1.6.0-18.11.1
  • xorg-x11-Xvnc-1.6.0-18.11.1
  • tigervnc-debuginfo-1.6.0-18.11.1
  • xorg-x11-Xvnc-debuginfo-1.6.0-18.11.1
  • tigervnc-1.6.0-18.11.1

References:

• https://www.suse.com/security/cve/CVE-2017-7392.html
• https://www.suse.com/security/cve/CVE-2017-7393.html
• https://www.suse.com/security/cve/CVE-2017-7394.html
• https://www.suse.com/security/cve/CVE-2017-7395.html
• https://www.suse.com/security/cve/CVE-2017-7396.html
• https://bugzilla.suse.com/show_bug.cgi?id=1024929
• https://bugzilla.suse.com/show_bug.cgi?id=1026833
• https://bugzilla.suse.com/show_bug.cgi?id=1031045
• https://bugzilla.suse.com/show_bug.cgi?id=1031875
• https://bugzilla.suse.com/show_bug.cgi?id=1031877
• https://bugzilla.suse.com/show_bug.cgi?id=1031879
• https://bugzilla.suse.com/show_bug.cgi?id=1031886
• https://bugzilla.suse.com/show_bug.cgi?id=1032272
• https://bugzilla.suse.com/show_bug.cgi?id=1032880