CVE-2018-21247

HIGH 7.5CVE-2018-21247 · Published 17/06/2020 · updated 17/06/2026

In short

CVE-2018-21247 is a HIGH (CVSS 7.5) vulnerability affecting libvncserver (libvnc project).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libvncserver libvnc_project	`≤ 0.9.12`	No fix yet

Description

An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html · Mailing List
cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf · Patch
LibVNC/libvncserver · Patch
LibVNC/libvncserver · Issue Tracking
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ

More vulnerabilities in libvncserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free