1. CVE-Search
  2. CVE-2018-20020
ID CVE-2018-20020
Summary LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution
References
Vulnerable Configurations
  • cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*
    cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 23-10-2020 - 13:15)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
debian DSA-4383
gentoo
  • GLSA-201908-05
  • GLSA-202006-06
misc https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/
mlist
  • [debian-lts-announce] 20181227 [SECURITY] [DLA 1617-1] libvncserver security update
  • [debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update
  • [debian-lts-announce] 20191129 [SECURITY] [DLA 2016-1] ssvnc security update
ubuntu
  • USN-3877-1
  • USN-4547-1
  • USN-4547-2
  • USN-4587-1
Last major update 23-10-2020 - 13:15
Published 19-12-2018 - 16:29
Last modified 23-10-2020 - 13:15
Back to Top