SUSE-SU-2020:0112-1

CVE-2019-15691: Fixed a use-after-return due to incorrect usage of stack memory in ZRLEDecoder (bsc#1159856).
CVE-2019-15692: Fixed a heap-based buffer overflow in CopyRectDecode (bsc#1160250).
CVE-2019-15693: Fixed a heap-based buffer overflow in TightDecoder::FilterGradient (bsc#1159858).
CVE-2019-15694: Fixed a heap-based buffer overflow, caused by improper error handling in processing MemOutStream (bsc#1160251).
CVE-2019-15695: Fixed a stack-based buffer overflow, which could be triggered from CMsgReader::readSetCursor (bsc#1159860).

References

Affected packages

SUSE:Linux Enterprise Module for Basesystem 15 / tigervnc

Package

Name: tigervnc
Purl: pkg:rpm/suse/tigervnc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0-13.11.1

Ecosystem specific

{
    "binaries": [
        {
            "xorg-x11-Xvnc": "1.8.0-13.11.1",
            "libXvnc1": "1.8.0-13.11.1",
            "tigervnc": "1.8.0-13.11.1",
            "xorg-x11-Xvnc-novnc": "1.8.0-13.11.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Desktop Applications 15 / tigervnc

Package

Name: tigervnc
Purl: pkg:rpm/suse/tigervnc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.0-13.11.1

Ecosystem specific

{
    "binaries": [
        {
            "libXvnc-devel": "1.8.0-13.11.1"
        }
    ]
}