Pavel Cheremushkin

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.540 and older Description: The issue allows an authenticated user to run commands as the root user due to a command injection vulnerability. Recommendations: For Fibaro Home Center 2 and Lite versions 4.540 and older, update to a version newer than 4.540 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.44 Oracle VM VirtualBox versions prior to 6.0.24 Oracle VM VirtualBox versions prior to 6.1.12 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. A successful attack can result in the takeover of Oracle VM VirtualBox. The vulnerability is difficult to exploit and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is executed. **Recommendations** For versions prior to 5.2.44, update to version 5.2.44 or later. For versions prior to 6.0.24, update to version 6.0.24 or later. For versions prior to 6.1.12, update to version 6.1.12 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox. It allows a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, potentially impacting additional products. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** LibVNCServer versions 0.9.12 and earlier **Description** The issue is related to a heap buffer overflow in the `HandleCursorShape()` function in `libvncclient/cursor.c`. This can be exploited by an attacker sending cursor shapes with specially crafted dimensions, potentially allowing remote code execution when connected to a malicious server. **Recommendations** For LibVNCServer versions 0.9.12 and earlier, consider disabling the `HandleCursorShape()` function until a patch is available to prevent potential remote code execution. Restrict access to the `libvncclient/cursor.c` module to minimize the risk of exploitation. Avoid using large cursor sizes when connected to untrusted servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TigerVNC versions prior to 1.10.1 **Description** The issue is related to insufficient checking of unusual or exceptional states in the CMsgReader::readSetCursor function of the VNC TigerVNC software. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability occurs due to insufficient sanitization of `PixelFormat`. Exploitation could potentially result in remote code execution, as an attacker can choose the offset from the start of the buffer to start writing their values. This attack appears to be exploitable via network connectivity. **Recommendations** For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TigerVNC versions prior to 1.10.1 **Description** The issue is related to a buffer data boundary overflow in the DecodeManager::decodeRect function of the VNC TigerVNC software. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability occurs due to a sign error in processing MemOutStream and could potentially result in remote code execution via network connectivity. **Recommendations** For TigerVNC versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TigerVNC versions prior to 1.10.1 **Description** The issue is related to a use-after-free error in the ZRLEDecoder of TigerVNC, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability occurs due to incorrect usage of stack memory in the ZRLEDecoder, potentially allowing remote code execution if the decoding routine throws an exception. This can be exploited via network connectivity. **Recommendations** For versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TigerVNC versions prior to 1.10.1 **Description** The issue is related to a heap buffer overflow in the `TightDecoder::FilterGradient` function, which could potentially lead to remote code execution. This can be exploited via network connectivity, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For TigerVNC versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibVNCServer versions 0.9.12 and earlier **Description** The issue is related to an integer overflow and heap-based buffer overflow in the `libvncclient/cursor.c` file of LibVNCServer. This can be triggered via a large height or width value in the `HandleCursorShape` function. **Recommendations** For LibVNCServer versions 0.9.12 and earlier, as a temporary workaround, consider restricting the input values for height and width to prevent large values from being processed by the `HandleCursorShape` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TightVNC version 1.3.10 **Description** The issue is related to a heap buffer overflow in the `rfbServerCutText` handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. The vulnerability is associated with a buffer data boundary overflow, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For TightVNC version 1.3.10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TightVNC version 1.3.10 **Description** The issue is related to a global buffer overflow in the HandleCoRREBBP macro function. This can potentially result in code execution and is exploitable via network connectivity. The vulnerability is associated with a lack of mechanism for checking the size of copied data, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For TightVNC version 1.3.10, consider disabling the HandleCoRREBBP macro function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TightVNC version 1.3.10 **Description** The issue is related to a null pointer dereference in the `HandleZlibBPP` function, which can result in a Denial of System (DoS). This can be exploited via network connectivity, potentially allowing a remote attacker to cause a service disruption. **Recommendations** For TightVNC version 1.3.10, consider disabling the `HandleZlibBPP` function as a temporary workaround until a patch is available. Restrict access to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TightVNC version 1.3.10 **Description** The issue is related to a heap buffer overflow in the InitialiseRFBConnection function, potentially allowing code execution. This can be exploited via network connectivity, and may enable a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For TightVNC version 1.3.10, consider disabling the InitialiseRFBConnection function as a temporary workaround until a patch is available. Restrict access to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TigerVNC versions prior to 1.10.1 **Description** The issue is related to a heap buffer overflow in the CopyRectDecoder of TigerVNC, caused by incorrect value checks. This could potentially lead to remote code execution when exploited. The attack is exploitable via network connectivity, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For TigerVNC versions prior to 1.10.1, update to version 1.10.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibVNCServer versions prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a **Description** The issue is related to a memory leak in the VNC server code, which can be exploited by an attacker to read stack memory and disclose information. This can be combined with another vulnerability to bypass ASLR. The attack is exploitable via network connectivity. **Recommendations** For versions prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a, update to a version that includes the fix from commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibVNC through 0.9.12 **Description** The issue is related to a heap out-of-bounds write vulnerability in the rfbserver.c component of the LibVNCServer library. This vulnerability can be exploited by a remote attacker to cause a denial of service and gain unauthorized access to sensitive data. **Recommendations** For LibVNC through 0.9.12, consider applying the necessary patches or fixes to address the incomplete fix for the issue. As a temporary workaround, restrict access to the vulnerable `rfbserver.c` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibVNC versions prior to 0.9.12 **Description** The issue is related to a heap out-of-bounds write vulnerability in the rfbserver.c component of the LibVNCServer library. This vulnerability can be exploited by a remote attacker to cause a denial of service and gain unauthorized access to sensitive data. **Recommendations** For versions prior to 0.9.12, update to version 0.9.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** LibVNC versions prior to 0.9.12 **Description** The issue is related to multiple heap out-of-bounds write vulnerabilities in the `rfbproto.c` component of the LibVNC library. This could allow a remote attacker to cause a denial of service and gain unauthorized access to confidential data. The problem is associated with a buffer overflow in memory. **Recommendations** For LibVNC versions prior to 0.9.12, update to version 0.9.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the `rfbproto.c` component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** LibVNC versions prior to 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 **Description** The issue is related to improper initialization in the VNC client code, allowing an attacker to read stack memory. This can be abused for information disclosure. When combined with another weakness, it can leak the stack memory layout and potentially bypass Address Space Layout Randomization (ASLR). The vulnerability can be exploited by a remote attacker to disclose protected information. **Recommendations** For LibVNC versions prior to 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838, update to a version that includes the fix for the improper initialization vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.