Changelog
vino (3.22.0-3ubuntu1.1) bionic-security; urgency=medium
* SECURITY UPDATE: DoS via unchecked malloc
- debian/patches/CVE-2014-6053.patch: check malloc() return value in
server/libvncserver/rfbserver.c.
- CVE-2014-6053
* SECURITY UPDATE: client cut length issue
- debian/patches/CVE-2018-7225.patch: limit client cut text length to
1 MB in server/libvncserver/rfbserver.c.
- CVE-2018-7225
* SECURITY UPDATE: information disclosure via memory leak
- debian/patches/CVE-2019-15681.patch: don't leak stack memory to the
remote in server/libvncserver/rfbserver.c.
- CVE-2019-15681
* SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2020-14397.patch: add missing NULL pointer checks
in server/libvncserver/rfbregion.c, server/libvncserver/rfbserver.c.
- CVE-2020-14397
* SECURITY UPDATE: out-of-bounds access via encodings
- debian/patches/CVE-2020-1440x.patch: prevent OOB accesses in
server/libvncserver/corre.c, server/libvncserver/hextile.c,
server/libvncserver/rre.c.
- CVE-2020-14402
- CVE-2020-14403
- CVE-2020-14404
-- Marc Deslauriers <email address hidden> Tue, 06 Oct 2020 10:42:53 -0400