Bug#1132017: marked as done (libvncserver: CVE-2026-32854)
Your message dated Sat, 02 May 2026 20:48:32 + with message-id and subject line Bug#1132017: fixed in libvncserver 0.9.14+dfsg-1+deb12u1 has caused the Debian Bug report #1132017, regarding libvncserver: CVE-2026-32854 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1132017: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132017 Debian Bug Tracking System Contact [email protected] with problems --- Begin Message --- Source: libvncserver Version: 0.9.15+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team Hi, The following vulnerability was published for libvncserver. CVE-2026-32854[0]: | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) | contain null pointer dereference vulnerabilities in the HTTP proxy | handlers within httpProcessInput() in httpd.c that allow remote | attackers to cause a denial of service by sending specially crafted | HTTP requests. Attackers can exploit missing validation of strchr() | return values in the CONNECT and GET proxy handling paths to trigger | null pointer dereferences and crash the server when httpd and proxy | features are enabled. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-32854 https://www.cve.org/CVERecord?id=CVE-2026-32854 [1] https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x [2] https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 Please adjust the affected versions in the BTS as needed. Regards, Salvatore --- End Message --- --- Begin Message --- Source: libvncserver Source-Version: 0.9.14+dfsg-1+deb12u1 Done: Sven Geuer We believe that the bug you reported is fixed in the latest version of libvncserver, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sven Geuer (supplier of updated libvncserver package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Mon, 06 Apr 2026 22:58:49 +0200 Source: libvncserver Architecture: source Version: 0.9.14+dfsg-1+deb12u1 Distribution: bookworm Urgency: medium Maintainer: Debian Remote Maintainers Changed-By: Sven Geuer Closes: 1132016 1132017 Changes: libvncserver (0.9.14+dfsg-1+deb12u1) bookworm; urgency=medium . * Team upload. * debian/patches: + CVE-2026-32853: Add 0001_CVE-2026-32853.patch fixing a heap out-of-bounds read (Closes: #1132016). + CVE-2026-32854: Add 0002_CVE-2026-32854.patch fixing NULL pointer dereferences in httpd proxy handlers (Closes: #1132017). Checksums-Sha1: a707543cfe2d4ec880bbe7940cb6a0579252959d 2348 libvncserver_0.9.14+dfsg-1+deb12u1.dsc 179bea1e67dd3281d5f0af57f16c4ce80655b17e 16696 libvncserver_0.9.14+dfsg-1+deb12u1.debian.tar.xz fbaf448c0d6f86edfb26209a3927073d51ae0064 8878 libvncserver_0.9.14+dfsg-1+deb12u1_amd64.buildinfo Checksums-Sha256: 3a68f7a37f00e2b2fd5cd18eef5db45c81591a01d2e905e4fd3364f662959681 2348 libvncserver_0.9.14+dfsg-1+deb12u1.dsc 6cd66f294097213a4e41cb732b9c9262a4abf259d65fd0ae7eafa306b434a416 16696 libvncserver_0.9.14+dfsg-1+deb12u1.debian.tar.xz 4dd369fc4c2320cfa70dfcc35867b13ac8d9d28482488adb8cfe89cb3958a065 8878 libvncserver_0.9.14+dfsg-1+deb12u1_amd64.buildinfo Files: 583f048752a5315e21c689ca9affc244 2348 libs optional libvncserver_0.9.14+dfsg-1+deb12u1.dsc d96747479f459a0ec640c5963124ace9 16696 libs optional libvncserver_0.9.14+dfsg-1+deb12u1.debian.tar.xz 4b55e7fdab38cb9bef0ce52202f65f14 8878 libs optional libvncserver_0.9.14+dfsg-1+deb12u1_amd64.buildinfo -BEGIN PGP SIGNATURE- iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmnUHzIPHHNnZUBkZWJp YW4ub3JnAAoJEK31Dtr4rdWFffUP/2yWLOrOeLk/PVbAv2owzuyd92gGHEuo7Cn0 BI6aW0uHCnM4mylVn545DJJig3yxM1oktQpt0v45VwZsWQJfmMz6UI+HKB6jKIkV wTm8Sw8w/IFW1+eWmHYyI6eYi14JMueWA+3kypYYH666fyhp/IgJ1pkK1uAEHhqk 5/uG8eu1/+q+hWV6T/DE05si95MQE8YmasIpTqkzJWL7Q3OJg8UqnZZU6/BIXHL+ v4fC5LE9MOSPvVwVoOlvqCMySv685KHhg3iI3IG3034SqhtviugIu3KqZRZLgnag
Bug#1132017: marked as done (libvncserver: CVE-2026-32854)
Your message dated Sun, 19 Apr 2026 18:32:43 + with message-id and subject line Bug#1132017: fixed in libvncserver 0.9.15+dfsg-1+deb13u1 has caused the Debian Bug report #1132017, regarding libvncserver: CVE-2026-32854 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1132017: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132017 Debian Bug Tracking System Contact [email protected] with problems --- Begin Message --- Source: libvncserver Version: 0.9.15+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team Hi, The following vulnerability was published for libvncserver. CVE-2026-32854[0]: | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) | contain null pointer dereference vulnerabilities in the HTTP proxy | handlers within httpProcessInput() in httpd.c that allow remote | attackers to cause a denial of service by sending specially crafted | HTTP requests. Attackers can exploit missing validation of strchr() | return values in the CONNECT and GET proxy handling paths to trigger | null pointer dereferences and crash the server when httpd and proxy | features are enabled. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-32854 https://www.cve.org/CVERecord?id=CVE-2026-32854 [1] https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x [2] https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 Please adjust the affected versions in the BTS as needed. Regards, Salvatore --- End Message --- --- Begin Message --- Source: libvncserver Source-Version: 0.9.15+dfsg-1+deb13u1 Done: Sven Geuer We believe that the bug you reported is fixed in the latest version of libvncserver, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sven Geuer (supplier of updated libvncserver package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Mon, 06 Apr 2026 22:55:25 +0200 Source: libvncserver Architecture: source Version: 0.9.15+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian Remote Maintainers Changed-By: Sven Geuer Closes: 1132016 1132017 Changes: libvncserver (0.9.15+dfsg-1+deb13u1) trixie; urgency=medium . * Team upload. * debian/patches: + CVE-2026-32853: Add 0001_CVE-2026-32853.patch fixing a heap out-of-bounds read (Closes: #1132016). + CVE-2026-32854: Add 0002_CVE-2026-32854.patch fixing NULL pointer dereferences in httpd proxy handlers (Closes: #1132017). Checksums-Sha1: dccb764fd1a887c367d2050bcc0709cdfbdd3d7a 2345 libvncserver_0.9.15+dfsg-1+deb13u1.dsc 753c14b8c1af0d3dbf8e5424e6fb66d5dc075fea 19468 libvncserver_0.9.15+dfsg-1+deb13u1.debian.tar.xz f6daded08e986bf3fdca9337c50154b4ca116afe 8721 libvncserver_0.9.15+dfsg-1+deb13u1_amd64.buildinfo Checksums-Sha256: a9d0399b04d1a44c86c7c5236ad18685cf1fbc9e7546ad9f48199366f17bbd73 2345 libvncserver_0.9.15+dfsg-1+deb13u1.dsc 510285c36d733a1b8e5e5438354b01e528795d948f893b73c2d51b5d47de0c41 19468 libvncserver_0.9.15+dfsg-1+deb13u1.debian.tar.xz 560aa4a64f4e3b55231919a1f192a4efc2e3c4c7d1792a0ca9449767638b74cd 8721 libvncserver_0.9.15+dfsg-1+deb13u1_amd64.buildinfo Files: db859c41093337477ffc3fa97b9fe076 2345 libs optional libvncserver_0.9.15+dfsg-1+deb13u1.dsc a2da7080bdc38263ed8a9037b533823d 19468 libs optional libvncserver_0.9.15+dfsg-1+deb13u1.debian.tar.xz 4b0d70cf9c2c64a60244e384a13ebbe7 8721 libs optional libvncserver_0.9.15+dfsg-1+deb13u1_amd64.buildinfo -BEGIN PGP SIGNATURE- iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmnUHlkPHHNnZUBkZWJp YW4ub3JnAAoJEK31Dtr4rdWF820QAMtciPe5QNxle1pKCWfXZHRTvYkLPqnvyirP amzM2a9nZ+6WwnPxR2/iQ3sZl+x37boTlMaBNUVUcnlRMIbee3N9xxalYZFCJ8nj M37xIgJTk3U81eCOXPifhV2AyM9413Ddx9QSqoiOEqAJrYpBmT7trwFrO2EoDDML IydcFckz4loLWtTnMaNxJRTp9laRKG/mXJ7WapQUdI6rJF8vSdTTeedb02fmvENm f8SZp9EVvzSs2NMZxwi9iAW+DYuFNE/uqPETpb313hgS5KR+SIAfl7enPja+oe5e
Bug#1132017: marked as done (libvncserver: CVE-2026-32854)
Your message dated Fri, 03 Apr 2026 20:51:12 + with message-id and subject line Bug#1132017: fixed in libvncserver 0.9.15+dfsg-3 has caused the Debian Bug report #1132017, regarding libvncserver: CVE-2026-32854 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1132017: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132017 Debian Bug Tracking System Contact [email protected] with problems --- Begin Message --- Source: libvncserver Version: 0.9.15+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team Hi, The following vulnerability was published for libvncserver. CVE-2026-32854[0]: | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) | contain null pointer dereference vulnerabilities in the HTTP proxy | handlers within httpProcessInput() in httpd.c that allow remote | attackers to cause a denial of service by sending specially crafted | HTTP requests. Attackers can exploit missing validation of strchr() | return values in the CONNECT and GET proxy handling paths to trigger | null pointer dereferences and crash the server when httpd and proxy | features are enabled. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-32854 https://www.cve.org/CVERecord?id=CVE-2026-32854 [1] https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x [2] https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 Please adjust the affected versions in the BTS as needed. Regards, Salvatore --- End Message --- --- Begin Message --- Source: libvncserver Source-Version: 0.9.15+dfsg-3 Done: Sven Geuer We believe that the bug you reported is fixed in the latest version of libvncserver, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sven Geuer (supplier of updated libvncserver package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Fri, 03 Apr 2026 21:20:31 +0200 Source: libvncserver Architecture: source Version: 0.9.15+dfsg-3 Distribution: unstable Urgency: medium Maintainer: Debian Remote Maintainers Changed-By: Sven Geuer Closes: 1132016 1132017 Changes: libvncserver (0.9.15+dfsg-3) unstable; urgency=medium . * Team upload. * debian/patches: + CVE-2026-32853: Add 0001_CVE-2026-32853.patch fixing a heap out-of-bounds read (Closes: #1132016). + CVE-2026-32854: Add 0002_CVE-2026-32854.patch fixing NULL pointer dereferences in httpd proxy handlers (Closes: #1132017). Checksums-Sha1: f02baf4cc26575b327efed5476525fedeb821228 2313 libvncserver_0.9.15+dfsg-3.dsc b676cf72ed6318640b75e80d462f6a62e7b33e60 19680 libvncserver_0.9.15+dfsg-3.debian.tar.xz 8e8cefee7fd9460bdad68bf262389c9cb92c6760 8471 libvncserver_0.9.15+dfsg-3_amd64.buildinfo Checksums-Sha256: 0e4955de6337e3718bb10e3c7d0332f7416462aec06342d30eff1c001f511f44 2313 libvncserver_0.9.15+dfsg-3.dsc f5e6d5941520b0549aaba602f787fb3f0c85438f8efb4db811726d52f93aa2d8 19680 libvncserver_0.9.15+dfsg-3.debian.tar.xz 5981df0c21261821c468e0398c2e4efcb0f732da4fedee5a1c0431216725b6e4 8471 libvncserver_0.9.15+dfsg-3_amd64.buildinfo Files: f953c6426dccab6252c925674aefe693 2313 libs optional libvncserver_0.9.15+dfsg-3.dsc cbb47e01987600f5a7d5c779beb5cfbf 19680 libs optional libvncserver_0.9.15+dfsg-3.debian.tar.xz 50a778797d47a05c7f840cc27906d986 8471 libs optional libvncserver_0.9.15+dfsg-3_amd64.buildinfo -BEGIN PGP SIGNATURE- iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmnQFV0PHHNnZUBkZWJp YW4ub3JnAAoJEK31Dtr4rdWFdbYQAL15WUWJh/lDr3OTRbm/MT6P/+Oe4da7Dp9P L7723OAupKSGS+DpV4ervXnu03Qj58cxBAgH3CEsF6n0mau42Qu4e2Lfqn7HW7OB 7b4XGlMMz9xEkB6NZewpe7LvGErD8pfMJtdL5qFldDccZbxH0KO1ksQ1hjBBa66y FpR0i1hBsjJrSmk71p2u/5gTbO16QTtCgU7/u6hjWt5fHMpiunM3+9uyNndU+QkR 3l632DpIZRLFrAGZLr35h8yesrZtJ3Pm3A8qQ2L0uQ4uLmT4od10eU/MzqYBjDE8 WaD0alsuOnqK4iYxNW+Mtjzc0DKRdOibPNW9zKYet9TvsyJK3BhWeJkY04JKn4pA
