CVE-2018-20748

CRITICO 9.8CVE-2018-20748 · Published 30/01/2019 · updated 17/06/2026

In breve

CVE-2018-20748 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda libvncserver (libvnc project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.3%, superiore al 88.6% delle vulnerabilità.
Correzione: aggiornare a 0.9.12 o successiva.

Package	Affected versions	Patched versions
libvncserver libvnc_project	`< 0.9.12`	`0.9.12`

Description

LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.

References

cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf · Patch
LibVNC/libvncserver commit a64c3b3 · Patch
LibVNC/libvncserver commit c2c4b81 · Patch
LibVNC/libvncserver commit c5ba3fe · Patch
LibVNC/libvncserver commit e34bcbb · Patch
LibVNC/libvncserver · Issue Tracking
lists.debian.org/debian-lts-announce/2019/01/msg00029.html · Mailing List
lists.debian.org/debian-lts-announce/2019/10/msg00042.html · Mailing List
usn.ubuntu.com/3877-1 · Third Party Advisory
usn.ubuntu.com/4547-1 · Third Party Advisory
usn.ubuntu.com/4587-1 · Third Party Advisory
openwall.com/lists/oss-security/2018/12/10/8

Altre vulnerabilità di libvncserver

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libvncserver

libvnc_project

< 0.9.12

0.9.12

Altre vulnerabilità di libvncserver

Vedi tutto →