[El-errata] ELSA-2024-2080 Important: Oracle Linux 7 tigervnc security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2024-2080

http://linux.oracle.com/errata/ELSA-2024-2080.html

The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:

x86_64:
tigervnc-1.8.0-33.0.1.el7_9.x86_64.rpm
tigervnc-icons-1.8.0-33.0.1.el7_9.noarch.rpm
tigervnc-license-1.8.0-33.0.1.el7_9.noarch.rpm
tigervnc-server-1.8.0-33.0.1.el7_9.x86_64.rpm
tigervnc-server-applet-1.8.0-33.0.1.el7_9.noarch.rpm
tigervnc-server-minimal-1.8.0-33.0.1.el7_9.x86_64.rpm
tigervnc-server-module-1.8.0-33.0.1.el7_9.x86_64.rpm


SRPMS:
http://oss.oracle.com/ol7/SRPMS-updates//tigervnc-1.8.0-33.0.1.el7_9.src.rpm

Related CVEs:

CVE-2024-31080
CVE-2024-31081
CVE-2024-31083




Description of changes:

[1.8.0-33.0.1]
- Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch,
  xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch,
  xorg-CVE-2024-21886-1.patch, xorg-CVE-2024-21886-2.patch, xorg-dix-fix-use-after-free-in-input-device-shutdown.patch,
  xorg-CVE-2024-31080.patch, xorg-CVE-2024-31081.patch, xorg-CVE-2024-31082.patch, xorg-CVE-2024-31083.patch,
  xorg-CVE-2024-31083-followup.patch

[1.8.0-33]
- Fix crash caused by fix for CVE-2024-31083
  Resolves: RHEL-30976

[1.8.0-32]
- Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
  Resolves: RHEL-31006
- Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
  Resolves: RHEL-30976
- Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
  Resolves: RHEL-30993