MGASA-2014-0466

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0466.html
Import Source
https://advisories.mageia.org/MGASA-2014-0466.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2014-0466
Related
Published
2014-11-21T12:44:16Z
Modified
2014-11-21T11:57:04Z
Summary
Updated kdenetwork4 packages fix security vulnerabilities in krfb
Details

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter (CVE-2014-6053, CVE-2014-6054).

A malicious VNC client can trigger multiple stack-based buffer overflows by passing a long file and directory names and/or attributes (FileTime) when using the file transfer message feature (CVE-2014-6055).

The krfb package is built with a bundled copy of libvncserver.

References
Credits

Affected packages

Mageia:3 / kdenetwork4

Package

Name
kdenetwork4
Purl
pkg:rpm/mageia/kdenetwork4?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.10.5-1.3.mga3

Ecosystem specific 

{
    "section": "core"
}