CVE-2018-7225 · cross-distro fix matrix

CVE-2018-7225: An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packet

Affects 8 Linux releases across 13 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2018-7225 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

libvncserver→ fixed in0.9.11+dfsg-1.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvncserver
```
tightvnc→ fixed in1:1.3.9-9.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y tightvnc
```
vino→ fixed in3.22.0-6urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y vino
```

Source: Debian Security Tracker

libvncserver→ fixed in0.9.11+dfsg-1.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvncserver
```
tightvnc→ fixed in1:1.3.9-9.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y tightvnc
```
vino→ fixed in3.22.0-6urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y vino
```

Source: Debian Security Tracker

libvncserver→ fixed in0.9.11+dfsg-1.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvncserver
```
tightvnc→ fixed in1:1.3.9-9.1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y tightvnc
```