SUSE-SU-2026:1173-1
Vulnerability from csaf_suse - Published: 2026-04-02 12:43 - Updated: 2026-04-02 12:43Summary
Security update for LibVNCServer
Severity
Important
Notes
Title of the patch: Security update for LibVNCServer
Description of the patch: This update for LibVNCServer fixes the following issues:
- CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of service (bsc#1260431).
- CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).
Patchnames: SUSE-2026-1173,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1173,SUSE-SLE-Product-WE-15-SP7-2026-1173,openSUSE-SLE-15.6-2026-1173
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for LibVNCServer",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for LibVNCServer fixes the following issues:\n\n- CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of service (bsc#1260431). \n- CVE-2026-32854: crafted HTTP requests can cause a denial of service (bsc#1260429).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1173,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1173,SUSE-SLE-Product-WE-15-SP7-2026-1173,openSUSE-SLE-15.6-2026-1173",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1173-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1173-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261173-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1173-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045271.html"
},
{
"category": "self",
"summary": "SUSE Bug 1260429",
"url": "https://bugzilla.suse.com/1260429"
},
{
"category": "self",
"summary": "SUSE Bug 1260431",
"url": "https://bugzilla.suse.com/1260431"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32853 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32853/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32854 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32854/"
}
],
"title": "Security update for LibVNCServer",
"tracking": {
"current_release_date": "2026-04-02T12:43:10Z",
"generator": {
"date": "2026-04-02T12:43:10Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1173-1",
"initial_release_date": "2026-04-02T12:43:10Z",
"revision_history": [
{
"date": "2026-04-02T12:43:10Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"product": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"product_id": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.14-150600.3.6.1.aarch64",
"product": {
"name": "libvncclient1-0.9.14-150600.3.6.1.aarch64",
"product_id": "libvncclient1-0.9.14-150600.3.6.1.aarch64"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.14-150600.3.6.1.aarch64",
"product": {
"name": "libvncserver1-0.9.14-150600.3.6.1.aarch64",
"product_id": "libvncserver1-0.9.14-150600.3.6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.i586",
"product": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.i586",
"product_id": "LibVNCServer-devel-0.9.14-150600.3.6.1.i586"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.14-150600.3.6.1.i586",
"product": {
"name": "libvncclient1-0.9.14-150600.3.6.1.i586",
"product_id": "libvncclient1-0.9.14-150600.3.6.1.i586"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.14-150600.3.6.1.i586",
"product": {
"name": "libvncserver1-0.9.14-150600.3.6.1.i586",
"product_id": "libvncserver1-0.9.14-150600.3.6.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"product": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"product_id": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"product": {
"name": "libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"product_id": "libvncclient1-0.9.14-150600.3.6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"product": {
"name": "libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"product_id": "libvncserver1-0.9.14-150600.3.6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"product": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"product_id": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.14-150600.3.6.1.s390x",
"product": {
"name": "libvncclient1-0.9.14-150600.3.6.1.s390x",
"product_id": "libvncclient1-0.9.14-150600.3.6.1.s390x"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.14-150600.3.6.1.s390x",
"product": {
"name": "libvncserver1-0.9.14-150600.3.6.1.s390x",
"product_id": "libvncserver1-0.9.14-150600.3.6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"product": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"product_id": "LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncclient1-0.9.14-150600.3.6.1.x86_64",
"product": {
"name": "libvncclient1-0.9.14-150600.3.6.1.x86_64",
"product_id": "libvncclient1-0.9.14-150600.3.6.1.x86_64"
}
},
{
"category": "product_version",
"name": "libvncserver1-0.9.14-150600.3.6.1.x86_64",
"product": {
"name": "libvncserver1-0.9.14-150600.3.6.1.x86_64",
"product_id": "libvncserver1-0.9.14-150600.3.6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Workstation Extension 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Workstation Extension 15 SP7",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-we:15:sp7"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP7",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 15 SP7",
"product_id": "SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64"
},
"product_reference": "LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncclient1-0.9.14-150600.3.6.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64"
},
"product_reference": "libvncclient1-0.9.14-150600.3.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libvncserver1-0.9.14-150600.3.6.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
},
"product_reference": "libvncserver1-0.9.14-150600.3.6.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32853",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32853"
}
],
"notes": [
{
"category": "general",
"text": "LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32853",
"url": "https://www.suse.com/security/cve/CVE-2026-32853"
},
{
"category": "external",
"summary": "SUSE Bug 1260431 for CVE-2026-32853",
"url": "https://bugzilla.suse.com/1260431"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-02T12:43:10Z",
"details": "important"
}
],
"title": "CVE-2026-32853"
},
{
"cve": "CVE-2026-32854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32854"
}
],
"notes": [
{
"category": "general",
"text": "LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32854",
"url": "https://www.suse.com/security/cve/CVE-2026-32854"
},
{
"category": "external",
"summary": "SUSE Bug 1260429 for CVE-2026-32854",
"url": "https://bugzilla.suse.com/1260429"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncclient1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libvncserver1-0.9.14-150600.3.6.1.s390x",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 15 SP7:libvncserver1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:LibVNCServer-devel-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncclient1-0.9.14-150600.3.6.1.x86_64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.aarch64",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.ppc64le",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.s390x",
"openSUSE Leap 15.6:libvncserver1-0.9.14-150600.3.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-02T12:43:10Z",
"details": "important"
}
],
"title": "CVE-2026-32854"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…