SB2020092818 - Ubuntu update for italc



SB2020092818 - Ubuntu update for italc

Published: September 28, 2020 Updated: April 23, 2025

Security Bulletin ID SB2020092818
Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 8% Low 42%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 secuirty vulnerabilities.


1) Memory leak (CVE-ID: CVE-2019-15681)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due memory leak in VNC server code. A remote attacker can read stack memory and disclose sensitive information.

Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.


2) Heap out-of-bounds write (CVE-ID: CVE-2018-15127)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.


3) Heap out-of-bounds write (CVE-ID: CVE-2018-20019)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.


4) Heap out-of-bounds write (CVE-ID: CVE-2018-20020)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in inside structure in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.


5) Infinite loop (CVE-ID: CVE-2018-20021)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in VNC client code. A remote attacker can consume excessive amount of resources like CPU and RAM and perform a denial of service (DoS) attack.


6) Memory leak (CVE-ID: CVE-2018-20022)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.


7) Memory leak (CVE-ID: CVE-2018-20023)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.


8) NULL pointer dereference (CVE-ID: CVE-2018-20024)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in VNC client code. A remote attacker can perform a denial of service (DoS) attack.


9) Heap out-of-bounds write (CVE-ID: CVE-2018-20748)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in VNC client code and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


10) Heap out-of-bounds write (CVE-ID: CVE-2018-20749)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in rfbserver.c and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


11) Heap out-of-bounds write (CVE-ID: CVE-2018-20750)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in rfbserver.c and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


12) Integer overflow (CVE-ID: CVE-2018-7225)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the rfbProcessClientNormalMessage() function due to integer overflow. A remote attacker can trigger memory corruption and gain access to potentially sensitive information.


Remediation

Install update from vendor's website.