==========================================================================
Ubuntu Security Notice USN-3171-1
January 11, 2017

libvncserver vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in LibVNCServer.

Software Description:
– libvncserver: vnc server library

Details:

Josef Gajdusek discovered that the LibVNCServer client library incorrectly
handled certain FrameBufferUpdate messages. If a user were tricked into
connecting to a malicious server, an attacker could use this issue to cause
a denial of service, or possibly execute arbitrary code. (CVE-2016-9941,
CVE-2016-9942)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
libvncclient1 0.9.10+dfsg-3ubuntu0.16.10.1
libvncserver1 0.9.10+dfsg-3ubuntu0.16.10.1

Ubuntu 16.04 LTS:
libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.1
libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.1

Ubuntu 14.04 LTS:
libvncserver0 0.9.9+dfsg-1ubuntu1.2

Ubuntu 12.04 LTS:
libvncserver0 0.9.8.2-2ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-3171-1
CVE-2016-9941, CVE-2016-9942

Package Information:
https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.10.1
https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/libvncserver/0.9.9+dfsg-1ubuntu1.2
https://launchpad.net/ubuntu/+source/libvncserver/0.9.8.2-2ubuntu1.2

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAEBCgAGBQJYdnl2AAoJEGVp2FWnRL6T4acP/1EZOu6c2JT5p1o0+GxsTbSH
RxMEG7F53UJ8n65ksd1N2os9pn3P8sn1vzqEUuh1EdW+e6UlN7/0efXnla6Ldubd
eGs4XpmSVwFHGhwrNJhYqLwUjo7nneHvq6qXJKeJQ5CuBH7CuW3PF2M6uXqvJp4G
cYDbcqrnS9hJOasp98fx3jGoiVIXBD9dgCq91nbdjkMwb6IgPwT4/+0Az6vet9H1
8rzRtehMJUPLRrTirwjel5I9Su1e8fmZphMo1rx57lO8zl4Gj4DE5WQJiZ3HUnJP
cX+tvmNI2fvAcQ5UWgrRjNQIMIumScYjmOcCi0WvP/BaGgZnlGFGyJzXlsZAG0DC
QyD6Rq4vVhKGh6HJRGtejQV17qW5U1e4FFavpm/ntiUucsN8r9GBOCnrNbLCuYz8
Tk+lkLs4JmXcS13/Oux19p2uOX7OLk/xqB7qFE+qNaDyT6i2WolKynH9n1IYY9gP
zvLBXW6ByfHKz6PrrWi3HgbdFrqK7jWNEQkqTgPWDEbd7brXq8pNYbjo3DuGzQV7
GniQaxrIu5GwWblG5LfzX6XDsqPxmCCfPbBi/9LtwGfinGMXLvDLHPqVF6LXjqNs
+GU5JETAv+WfRB9lzqVCWkTgfHbM+YxCMQ/4m+pQ2z6sTBkOJ4v7ISNNeS5I7pBZ
kRTbvkfcKFtmX5U0Rbwf
=LB9N
—–END PGP SIGNATURE—–
—