Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package LibVNCServer for openSUSE:Factory checked in at 2026-08-26 19:51:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/LibVNCServer (Old) and /work/SRC/openSUSE:Factory/.LibVNCServer.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "LibVNCServer" Wed Aug 26 19:51:06 2026 rev:51 rq:1373528 version:0.9.15 Changes: -------- --- /work/SRC/openSUSE:Factory/LibVNCServer/LibVNCServer.changes 2026-05-30 22:56:00.919053938 +0200 +++ /work/SRC/openSUSE:Factory/.LibVNCServer.new.1258/LibVNCServer.changes 2026-08-26 19:51:11.487377624 +0200 @@ -1,0 +2,7 @@ +Tue Aug 25 06:24:41 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer [bsc#1276218] + * LibVNCServer-CVE-2026-50538.patch + +------------------------------------------------------------------- New: ---- LibVNCServer-CVE-2026-50538.patch ----------(New B)---------- New: CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer [bsc#1276218] * LibVNCServer-CVE-2026-50538.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ LibVNCServer.spec ++++++ --- /var/tmp/diff_new_pack.I30sxK/_old 2026-08-26 19:51:12.593416578 +0200 +++ /var/tmp/diff_new_pack.I30sxK/_new 2026-08-26 19:51:12.596416683 +0200 @@ -40,6 +40,8 @@ Patch13: LibVNCServer-CVE-2026-32853.patch # CVE-2026-44988: missing validation of rectangle width in tight gradient decoding can lead to server-triggered out-of-bounds write [bsc#1266459] Patch14: LibVNCServer-CVE-2026-44988.patch +# CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer [bsc#1276218] +Patch15: LibVNCServer-CVE-2026-50538.patch BuildRequires: cmake BuildRequires: gcc-c++ BuildRequires: libavahi-devel ++++++ LibVNCServer-CVE-2026-50538.patch ++++++ >From 540332be3e0acc566fa64da6f1b4680c72c724dd Mon Sep 17 00:00:00 2001 From: "Bas.Levering" <[email protected]> Date: Fri, 29 May 2026 09:08:28 +0200 Subject: [PATCH] Merge commit from fork HandleTightBPP's basic-compression loop wrote each batch of decompressed rows straight into client->frameBuffer (via FilterCopy/Palette/Gradient) and only compared the running total against the rectangle height rh after the loop. A malicious or man-in-the-middle server can send a zlib stream that decompresses to more rows than rh, so the writes run past the end of the framebuffer allocation: an attacker-controlled heap out-of-bounds write reachable in a default build (Tight is advertised when built with libz+libjpeg), pre-authentication, from one FramebufferUpdate. Clamp numRows to the remaining height before calling filterFn, matching the existing house style (trle.c and the Tight JPEG path already clamp to the rectangle height). Co-authored-by: Bas Levering <[email protected]> --- src/libvncclient/tight.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c index dad5514f4..3ee0d5e07 100644 --- a/src/libvncclient/tight.c +++ b/src/libvncclient/tight.c @@ -341,6 +341,16 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh) numRows = (bufferSize - zs->avail_out) / rowSize; + /* The decompressed stream is server-controlled and may yield more rows + than the rectangle's declared height. filterFn() writes directly into + client->frameBuffer, so clamp here before writing to avoid running past + the framebuffer (heap out-of-bounds write). The post-loop + "rowsProcessed != rh" check happens too late. */ + if (numRows > rh - rowsProcessed) { + rfbClientLog("Tight: too many scan lines after decompression.\n"); + return FALSE; + } + filterFn(client, rx, ry+rowsProcessed, numRows); extraBytes = bufferSize - zs->avail_out - numRows * rowSize;
