SB2020092818 - Ubuntu update for italc
Published: September 28, 2020 Updated: April 23, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2019-15681)
The vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due memory leak in VNC server code. A remote attacker can read stack memory and disclose sensitive information.
Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR.
2) Heap out-of-bounds write (CVE-ID: CVE-2018-15127)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap out-of-bounds write in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
3) Heap out-of-bounds write (CVE-ID: CVE-2018-20019)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap out-of-bounds write in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
4) Heap out-of-bounds write (CVE-ID: CVE-2018-20020)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap out-of-bounds write in inside structure in VNC client code. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
5) Infinite loop (CVE-ID: CVE-2018-20021)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in VNC client code. A remote attacker can consume excessive amount of resources like CPU and RAM and perform a denial of service (DoS) attack.
6) Memory leak (CVE-ID: CVE-2018-20022)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.
7) Memory leak (CVE-ID: CVE-2018-20023)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due memory leak in VNC Repeater client code. A remote attacker can read stack memory and bypass ASLR.
8) NULL pointer dereference (CVE-ID: CVE-2018-20024)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in VNC client code. A remote attacker can perform a denial of service (DoS) attack.
9) Heap out-of-bounds write (CVE-ID: CVE-2018-20748)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in VNC client code and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Heap out-of-bounds write (CVE-ID: CVE-2018-20749)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in rfbserver.c and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Heap out-of-bounds write (CVE-ID: CVE-2018-20750)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger out-of-bounds write in rfbserver.c and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Integer overflow (CVE-ID: CVE-2018-7225)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists in the rfbProcessClientNormalMessage() function due to integer overflow. A remote attacker can trigger memory corruption and gain access to potentially sensitive information.
Remediation
Install update from vendor's website.