Debian Package Tracker

general

source: tigervnc (main)
version: 1.10.1+dfsg-1
maintainer: TigerVNC Packaging Team (archive) (DMD)
uploaders: Liang Guo [DMD] – Yaroslav Halchenko [DMD] – Mike Gabriel [DMD] – Ola Lundqvist [DMD] – Joachim Falk [DMD] [DM]
arch: any
std-ver: 4.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.7.0+dfsg-7
stable: 1.9.0+dfsg-3
testing: 1.10.1+dfsg-1
unstable: 1.10.1+dfsg-1

versioned links

1.7.0+dfsg-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.9.0+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.10.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

tigervnc-common
tigervnc-scraping-server
tigervnc-standalone-server (1 bugs: 0, 1, 0, 0)
tigervnc-viewer (3 bugs: 0, 2, 1, 0)
tigervnc-xorg-extension (4 bugs: 0, 4, 0, 0)

action needed

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-01-06 Last update: 2020-01-23 22:32

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit e69c6a7e3000a04e1907aa4deb98879125d016d0
Author: Joachim Falk <joachim.falk@gmx.de>
Date:   Mon Jan 6 11:13:26 2020 +0100

    Updated abstract of patch 0177-tigervnc-1.10.1-fix-setupShm-wrong-width-heigh-method.patch with feedback from Pierre Ossman.

commit 6e8d1e0982f56d51d8c053e7358a805f6946a964
Author: Joachim Falk <joachim.falk@gmx.de>
Date:   Mon Jan 6 11:07:02 2020 +0100

    More excludes for uscan.

Created: 2019-12-21 Last update: 2020-01-23 18:34

5 ignored security issues in buster low

There are 5 open security issues in buster.

5 issues skipped by the security teams:

CVE-2019-15695: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15691: TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15694: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15693: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15692: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Please fix them.

Created: 2019-12-26 Last update: 2020-01-18 22:49

5 ignored security issues in stretch low

There are 5 open security issues in stretch.

5 issues skipped by the security teams:

CVE-2019-15695: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15691: TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15694: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15693: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE-2019-15692: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Please fix them.

Created: 2019-12-26 Last update: 2020-01-18 22:49

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2016-10-14 Last update: 2016-10-14 19:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.4.0).

Created: 2018-12-23 Last update: 2020-01-21 05:06

news

[rss feed]

[2020-01-02] tigervnc 1.10.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-12-30] Accepted tigervnc 1.10.1+dfsg-1 (source) into unstable (Mike Gabriel)
[2019-10-05] tigervnc 1.9.0+dfsg-4 MIGRATED to testing (Debian testing watch)
[2019-09-29] Accepted tigervnc 1.9.0+dfsg-4 (source) into unstable (Mike Gabriel)
[2018-12-07] tigervnc 1.9.0+dfsg-3 MIGRATED to testing (Debian testing watch)
[2018-12-01] Accepted tigervnc 1.9.0+dfsg-3 (source) into unstable (Mike Gabriel)
[2018-10-29] Accepted tigervnc 1.9.0+dfsg-2 (source) into unstable (Mike Gabriel)
[2018-08-04] tigervnc 1.9.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-07-30] Accepted tigervnc 1.9.0+dfsg-1 (source amd64) into unstable (Yaroslav Halchenko)
[2018-07-27] tigervnc REMOVED from testing (Debian testing watch)
[2017-12-06] tigervnc 1.7.0+dfsg-8 MIGRATED to testing (Debian testing watch)
[2017-12-04] Accepted tigervnc 1.7.0+dfsg-8 (source amd64) into unstable (Ola Lundqvist)
[2017-04-12] tigervnc 1.7.0+dfsg-7 MIGRATED to testing (Debian testing watch)
[2017-04-09] Accepted tigervnc 1.7.0+dfsg-7 (source amd64) into unstable (Yaroslav Halchenko)
[2017-02-15] tigervnc 1.7.0+dfsg-6 MIGRATED to testing (Debian testing watch)
[2017-02-09] Accepted tigervnc 1.7.0+dfsg-6 (source amd64) into unstable (Ola Lundqvist)
[2017-02-09] tigervnc 1.7.0+dfsg-5 MIGRATED to testing (Debian testing watch)
[2017-02-04] Accepted tigervnc 1.7.0+dfsg-5 (source amd64) into unstable (Ola Lundqvist)
[2017-01-30] Accepted tigervnc 1.7.0+dfsg-4 (source amd64) into unstable (Ola Lundqvist)
[2017-01-28] Accepted tigervnc 1.7.0+dfsg-3 (source amd64) into unstable (Ola Lundqvist)
[2017-01-16] tigervnc 1.7.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2017-01-05] Accepted tigervnc 1.7.0+dfsg-2 (source amd64) into unstable (Ola Lundqvist)
[2017-01-02] Accepted tigervnc 1.7.0+dfsg-1 (source amd64) into unstable (Ola Lundqvist)
[2017-01-02] tigervnc 1.7.0-2 MIGRATED to testing (Debian testing watch)
[2016-12-30] Accepted tigervnc 1.7.0-1 (source amd64) into unstable (Ola Lundqvist)
[2016-12-30] Accepted tigervnc 1.7.0-2 (source amd64) into unstable (Ola Lundqvist)
[2016-10-26] tigervnc 1.6.0+dfsg-4 MIGRATED to testing (Debian testing watch)
[2016-10-20] Accepted tigervnc 1.6.0+dfsg-4 (source) into unstable (Ola Lundqvist)
[2016-10-15] Accepted tigervnc 1.6.0+dfsg-3 (source amd64) into unstable (Ola Lundqvist)
[2016-10-14] Accepted tigervnc 1.6.0+dfsg-2 (source amd64) into unstable, unstable (Yaroslav Halchenko)

bugs [bug history graph]

all: 8
RC: 0
I&N: 7
M&W: 1
F&P: 0
patch: 0

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.10.1+dfsg-1
4 bugs