Updated synergy packages fix a security vulnerability
Publication date: 17 Jan 2021Modification date: 17 Jan 2021
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-15117
Description
In Synergy before version 1.12.0, a Synergy server can be crashed by receiving
a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295)
if the servers memory is less than 4 GB. It was verified that this issue does
not cause a crash through the exception handler if the available memory of the
Server is more than 4GB (CVE-2020-15117).
The synergy package has been updated to version 1.12.0, fixing this issue and
several other bugs.
References
- https://bugs.mageia.org/show_bug.cgi?id=27851
- https://github.com/symless/synergy-core/security/advisories/GHSA-chfm-333q-gfpp
- https://github.com/symless/synergy-core/releases/tag/1.11.0-stable
- https://github.com/symless/synergy-core/releases/tag/v1.11.1-stable
- https://github.com/symless/synergy-core/releases/tag/v1.12.0-stable
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VFDEQED64YLWQK2TF73EMXZDYX7YT2DD/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15117
SRPMS
7/core
- synergy-1.12.0-1.mga7