From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] tigervnc (SSA:2024-304-01)
Date: Wed, 30 Oct 2024 15:03:51 -0700 (PDT)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] tigervnc (SSA:2024-304-01)

New tigervnc packages are available for Slackware 15.0 and -current to
fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
extra/tigervnc/tigervnc-1.12.0-i586-7_slack15.0.txz: Rebuilt.
Recompiled against xorg-server-1.20.14, including a patch for a
security issue:
By providing a modified bitmap, a heap-based buffer overflow may occur.
This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
For more information, see:
https://lists.x.org/archives/xorg-announce/2024-October/003545.html
https://www.cve.org/CVERecord?id=CVE-2024-9632
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/extra/tigervnc/tigervnc-1.12.0-i586-7_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/extra/tigervnc/tigervnc-1.12.0-x86_64-7_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/extra/tigervnc/tigervnc-1.14.1-i686-2.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/extra/tigervnc/tigervnc-1.14.1-x86_64-2.txz


MD5 signatures:
+-------------+

Slackware 15.0 package:
be3a49072d40d88679fe7e99a7558c42 tigervnc-1.12.0-i586-7_slack15.0.txz

Slackware x86_64 15.0 package:
497891bf3f14426d6456314d8fb0bff0 tigervnc-1.12.0-x86_64-7_slack15.0.txz

Slackware -current package:
0dbde067502e39c711e3ccd372c369a4 tigervnc-1.14.1-i686-2.txz

Slackware x86_64 -current package:
0375267af2e5bdc5c11acb9b9693f258 tigervnc-1.14.1-x86_64-2.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg tigervnc-1.12.0-i586-7_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCZyKnwQAKCRBqRGPAQBAi
M25eAJ94Z75SWT4eoAQfifpjntq5hv0hogCeMjZ537UUcSFeJxaUqYS2jzenETA=
=mwDZ
-----END PGP SIGNATURE-----

Senaste Kernels