Please update embedded common/zlib version to address zlib related CVEs about turbovnc HOT 6 CLOSED

Also CVE-2018-25032

from turbovnc.

I will revisit whether it makes sense to continue using the Intel zlib implementation at all, since it is now only used by the TurboVNC Server. If it still makes sense, I'll update to their latest code.

from turbovnc.

Even with raw TurboVNC encoder benchmarks, there is no longer a compelling speedup relative to the system-installed version of zlib, so I'm just going to remove our in-tree version.

from turbovnc.

Sorry for the delay. I'm not sure what happened with the results I obtained in April, but they were apparently bogus. I re-ran the same benchmarks today with both 64-bit and 32-bit code and still see a significant enough speedup with the Intel zlib implementation to justify its inclusion. I see the same speedup with the new (1.2.13) Intel zlib implementation as with our current implementation, which is based on zlib 1.2.8.

Comments regarding TurboVNC's exposure to the security issues in question:

• CVE-2022-37434 is not applicable because TurboVNC never reads gzip headers via inflateGetHeader().
• CVE-2016-9843 is probably not applicable because TurboVNC never directly performs CRC32 calculations. (That issue only affected big endian architectures anyhow, which are not officially supported by TurboVNC. Also, to the best of my understanding, the issue involved behavior that worked in reality but was technically undefined per the C standard.)
• CVE-2018-25032 is not applicable because TurboVNC never uses Z_FIXED.

That being said, the new 1.2.13 Intel zlib implementation is easier to build and does a much better job of run-time CPU feature detection, so it's worth upgrading for those reasons. I am testing whether it makes sense to always use the system zlib implementation for non-x86 architectures.

from turbovnc.

Thanks for the update.

from turbovnc.

Since this is a non-critical issue, I have committed the new zlib code to the dev branch (TurboVNC 3.1 evolving.)

from turbovnc.