var-202006-1841
Vulnerability from variot

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. LibVNCServer Is vulnerable to resource allocation without restrictions or throttling.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: libvncserver security update Advisory ID: RHSA-2021:1811-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1811 Issue date: 2021-05-18 CVE Names: CVE-2018-21247 CVE-2019-20839 CVE-2020-14397 CVE-2020-14405 CVE-2020-25708 ==================================================================== 1. Summary:

An update for libvncserver is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

  1. Description:

LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

Security Fix(es):

  • libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  • libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  • libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  • libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  • libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

  1. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

1849877 - CVE-2019-20839 libvncserver: buffer overflow in ConnectClientToUnixSock() 1849886 - CVE-2018-21247 libvncserver: uninitialized memory contents are vulnerable to Information Leak 1860325 - CVE-2020-14405 libvncserver: libvncclient/rfbproto.c does not limit TextChat size 1860344 - CVE-2020-14397 libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference 1896739 - CVE-2020-25708 libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS

  1. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source: libvncserver-0.9.11-17.el8.src.rpm

aarch64: libvncserver-0.9.11-17.el8.aarch64.rpm libvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm libvncserver-debugsource-0.9.11-17.el8.aarch64.rpm

ppc64le: libvncserver-0.9.11-17.el8.ppc64le.rpm libvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm libvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm

s390x: libvncserver-0.9.11-17.el8.s390x.rpm libvncserver-debuginfo-0.9.11-17.el8.s390x.rpm libvncserver-debugsource-0.9.11-17.el8.s390x.rpm

x86_64: libvncserver-0.9.11-17.el8.i686.rpm libvncserver-0.9.11-17.el8.x86_64.rpm libvncserver-debuginfo-0.9.11-17.el8.i686.rpm libvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm libvncserver-debugsource-0.9.11-17.el8.i686.rpm libvncserver-debugsource-0.9.11-17.el8.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

aarch64: libvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm libvncserver-debugsource-0.9.11-17.el8.aarch64.rpm libvncserver-devel-0.9.11-17.el8.aarch64.rpm

ppc64le: libvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm libvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm libvncserver-devel-0.9.11-17.el8.ppc64le.rpm

s390x: libvncserver-debuginfo-0.9.11-17.el8.s390x.rpm libvncserver-debugsource-0.9.11-17.el8.s390x.rpm libvncserver-devel-0.9.11-17.el8.s390x.rpm

x86_64: libvncserver-debuginfo-0.9.11-17.el8.i686.rpm libvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm libvncserver-debugsource-0.9.11-17.el8.i686.rpm libvncserver-debugsource-0.9.11-17.el8.x86_64.rpm libvncserver-devel-0.9.11-17.el8.i686.rpm libvncserver-devel-0.9.11-17.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

  1. Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIVAwUBYKPzPNzjgjWX9erEAQgJcQ//eFCPv7OwkNtF1owJhqkboBZSSILHH2sX bXDy/9rdYjrY13E6kfMdjvXQyfSa8RM1lB+3LldAA1LokLqf6aTEHrBrjDadAKSW 2FfxerEbatQLlQubcxtrb5gn3ZUv+8gf/n3E8Fgjxm4EQkCZC3TF7Smmj3ofELtq 2aYKRKyOGrMR2JZuySPuB5fm9/8LcYlfn5atG4Yqc4QofgGe2YhORY6GuneUOSBr Li0LBXpBI7o3VY0dosXListDptm8UEZ8sx/hUEqR2YEBoQoGF3EZsuNsqzYkG99e i6LmBTh8zCgsnOHKrLVmG00YauAdpPrgmOq2cay7bw0jhAzp+huLtSCZ5yvEbh8p xOXM0YbocGwSoKdJ6RGaquYD4Vw/aKHIxp1L6BE3hMe2lIt6dObu+VxtgFmUVDFv iUvmv9J1Jr7lZAByA0r+1gnnfrXyUc+ln3jhuu0xZ3tQvGiEAKAsvDNB8/78TCT/ CmuU0jwvBxTqeISxAaWcCrl9LHg+gZv6wop8j8L/BDyEY4zQgAT11nRo0cXjFaE0 YgmFxA5kAEqDiNr2k/kq3w+sUH9pdEhiJQTqTt0uZvHesKXaIKTa7YKnvPgWbolM Nhw8esGKItirSh536uT/9/4DIQegxxM8sx5PhQCwL5pKldNGwiLyuFUF2ypRu9KT 8A9MNz92TFY=uZts -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-4434-1 July 23, 2020

libvncserver vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in LibVNCServer.

Software Description: - libvncserver: vnc server library

Details:

Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitrary code. (CVE-2019-20839)

It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)

Christian Beier discovered that LibVNCServer incorrectly handled anonymous TLS connections. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14396)

It was discovered that LibVNCServer incorrectly handled region clipping. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14397)

It was discovered that LibVNCServer did not properly reset incorrectly terminated TCP connections. A remote attacker could possibly use this issue to cause an infinite loop, resulting in a denial of service. (CVE-2020-14398)

It was discovered that LibVNCServer did not properly access byte-aligned data. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399, CVE-2020-14400)

It was discovered that LibVNCServer incorrectly handled screen scaling on the server side. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14401)

It was discovered that LibVNCServer incorrectly handled encodings. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)

It was discovered that LibVNCServer incorrectly handled TextChat messages. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2020-14405)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.2 libvncserver1 0.9.12+dfsg-9ubuntu0.2

Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.3 libvncserver1 0.9.11+dfsg-1ubuntu1.3

Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.5 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.5

After a standard system update you need to restart LibVNCServer applications to make all the necessary changes.

References: https://usn.ubuntu.com/4434-1 CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397, CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401, CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405

Package Information: https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2 https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3 https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202006-1841",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "simatic itc2200",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "libvncserver",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "libvnc",
        "version": "0.9.12"
      },
      {
        "model": "simatic itc1500 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "simatic itc2200 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1900 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "simatic itc2200",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "simatic itc1900",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "simatic itc1500",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "simatic itc2200 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "simatic itc1900 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1500 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1900",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1500",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "libvncserver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "libvnc",
        "version": "0.9.13"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:libvncserver_project:libvncserver",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-14405",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2020-14405",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-006690",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-14405",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-006690",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-14405",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-006690",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202006-1184",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. LibVNCServer Is vulnerable to resource allocation without restrictions or throttling.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Moderate: libvncserver security update\nAdvisory ID:       RHSA-2021:1811-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:1811\nIssue date:        2021-05-18\nCVE Names:         CVE-2018-21247 CVE-2019-20839 CVE-2020-14397\n                   CVE-2020-14405 CVE-2020-25708\n====================================================================\n1. Summary:\n\nAn update for libvncserver is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nLibVNCServer is a C library that enables you to implement VNC server\nfunctionality into own programs. \n\nSecurity Fix(es):\n\n* libvncserver: uninitialized memory contents are vulnerable to Information\nLeak (CVE-2018-21247)\n\n* libvncserver: buffer overflow in ConnectClientToUnixSock()\n(CVE-2019-20839)\n\n* libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference\n(CVE-2020-14397)\n\n* libvncserver: libvncclient/rfbproto.c does not limit TextChat size\n(CVE-2020-14405)\n\n* libvncserver: libvncserver/rfbserver.c has a divide by zero which could\nresult in DoS (CVE-2020-25708)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.4 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1849877 - CVE-2019-20839 libvncserver: buffer overflow in ConnectClientToUnixSock()\n1849886 - CVE-2018-21247 libvncserver: uninitialized memory contents are vulnerable to Information Leak\n1860325 - CVE-2020-14405 libvncserver: libvncclient/rfbproto.c does not limit TextChat size\n1860344 - CVE-2020-14397 libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference\n1896739 - CVE-2020-25708 libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\nSource:\nlibvncserver-0.9.11-17.el8.src.rpm\n\naarch64:\nlibvncserver-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.aarch64.rpm\n\nppc64le:\nlibvncserver-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm\n\ns390x:\nlibvncserver-0.9.11-17.el8.s390x.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.s390x.rpm\nlibvncserver-debugsource-0.9.11-17.el8.s390x.rpm\n\nx86_64:\nlibvncserver-0.9.11-17.el8.i686.rpm\nlibvncserver-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.i686.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.i686.rpm\nlibvncserver-debugsource-0.9.11-17.el8.x86_64.rpm\n\nRed Hat CodeReady Linux Builder (v. 8):\n\naarch64:\nlibvncserver-debuginfo-0.9.11-17.el8.aarch64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.aarch64.rpm\nlibvncserver-devel-0.9.11-17.el8.aarch64.rpm\n\nppc64le:\nlibvncserver-debuginfo-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-debugsource-0.9.11-17.el8.ppc64le.rpm\nlibvncserver-devel-0.9.11-17.el8.ppc64le.rpm\n\ns390x:\nlibvncserver-debuginfo-0.9.11-17.el8.s390x.rpm\nlibvncserver-debugsource-0.9.11-17.el8.s390x.rpm\nlibvncserver-devel-0.9.11-17.el8.s390x.rpm\n\nx86_64:\nlibvncserver-debuginfo-0.9.11-17.el8.i686.rpm\nlibvncserver-debuginfo-0.9.11-17.el8.x86_64.rpm\nlibvncserver-debugsource-0.9.11-17.el8.i686.rpm\nlibvncserver-debugsource-0.9.11-17.el8.x86_64.rpm\nlibvncserver-devel-0.9.11-17.el8.i686.rpm\nlibvncserver-devel-0.9.11-17.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYKPzPNzjgjWX9erEAQgJcQ//eFCPv7OwkNtF1owJhqkboBZSSILHH2sX\nbXDy/9rdYjrY13E6kfMdjvXQyfSa8RM1lB+3LldAA1LokLqf6aTEHrBrjDadAKSW\n2FfxerEbatQLlQubcxtrb5gn3ZUv+8gf/n3E8Fgjxm4EQkCZC3TF7Smmj3ofELtq\n2aYKRKyOGrMR2JZuySPuB5fm9/8LcYlfn5atG4Yqc4QofgGe2YhORY6GuneUOSBr\nLi0LBXpBI7o3VY0dosXListDptm8UEZ8sx/hUEqR2YEBoQoGF3EZsuNsqzYkG99e\ni6LmBTh8zCgsnOHKrLVmG00YauAdpPrgmOq2cay7bw0jhAzp+huLtSCZ5yvEbh8p\nxOXM0YbocGwSoKdJ6RGaquYD4Vw/aKHIxp1L6BE3hMe2lIt6dObu+VxtgFmUVDFv\niUvmv9J1Jr7lZAByA0r+1gnnfrXyUc+ln3jhuu0xZ3tQvGiEAKAsvDNB8/78TCT/\nCmuU0jwvBxTqeISxAaWcCrl9LHg+gZv6wop8j8L/BDyEY4zQgAT11nRo0cXjFaE0\nYgmFxA5kAEqDiNr2k/kq3w+sUH9pdEhiJQTqTt0uZvHesKXaIKTa7YKnvPgWbolM\nNhw8esGKItirSh536uT/9/4DIQegxxM8sx5PhQCwL5pKldNGwiLyuFUF2ypRu9KT\n8A9MNz92TFY=uZts\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. ==========================================================================\nUbuntu Security Notice USN-4434-1\nJuly 23, 2020\n\nlibvncserver vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in LibVNCServer. \n\nSoftware Description:\n- libvncserver: vnc server library\n\nDetails:\n\nRamin Farajpour Cami discovered that LibVNCServer incorrectly handled\ncertain malformed unix socket names. A remote attacker could exploit this\nwith a crafted socket name, leading to a denial of service, or possibly\nexecute arbitrary code. (CVE-2019-20839)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-20840)\n\nChristian Beier discovered that LibVNCServer incorrectly handled anonymous\nTLS connections. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2020-14396)\n\nIt was discovered that LibVNCServer incorrectly handled region clipping. A\nremote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14397)\n\nIt was discovered that LibVNCServer did not properly reset incorrectly\nterminated TCP connections. A remote attacker could possibly use this\nissue to cause an infinite loop, resulting in a denial of service. \n(CVE-2020-14398)\n\nIt was discovered that LibVNCServer did not properly access byte-aligned\ndata. A remote attacker could possibly use this issue to cause\nLibVNCServer to crash, resulting in a denial of service. (CVE-2020-14399,\nCVE-2020-14400)\n\nIt was discovered that LibVNCServer incorrectly handled screen scaling on\nthe server side. A remote attacker could use this issue to cause\nLibVNCServer to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2020-14401)\n\nIt was discovered that LibVNCServer incorrectly handled encodings. A\nremote attacker could use this issue to cause LibVNCServer to crash,\nresulting in a denial of service, or possibly execute arbitrary code. \n(CVE-2020-14402, CVE-2020-14403, CVE-2020-14404)\n\nIt was discovered that LibVNCServer incorrectly handled TextChat messages. \nA remote attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service. (CVE-2020-14405)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n  libvncclient1                   0.9.12+dfsg-9ubuntu0.2\n  libvncserver1                   0.9.12+dfsg-9ubuntu0.2\n\nUbuntu 18.04 LTS:\n  libvncclient1                   0.9.11+dfsg-1ubuntu1.3\n  libvncserver1                   0.9.11+dfsg-1ubuntu1.3\n\nUbuntu 16.04 LTS:\n  libvncclient1                   0.9.10+dfsg-3ubuntu0.16.04.5\n  libvncserver1                   0.9.10+dfsg-3ubuntu0.16.04.5\n\nAfter a standard system update you need to restart LibVNCServer\napplications to make all the necessary changes. \n\nReferences:\n  https://usn.ubuntu.com/4434-1\n  CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397,\n  CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401,\n  CVE-2020-14402, CVE-2020-14403, CVE-2020-14404, CVE-2020-14405\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2\n  https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3\n  https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "db": "PACKETSTORM",
        "id": "158543"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-14405",
        "trust": 2.6
      },
      {
        "db": "SIEMENS",
        "id": "SSA-390195",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "162682",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158543",
        "trust": 0.7
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1705",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2248",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2535",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2972",
        "trust": 0.6
      },
      {
        "db": "NSFOCUS",
        "id": "48926",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021052205",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021121649",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "db": "PACKETSTORM",
        "id": "158543"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "id": "VAR-202006-1841",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.33603895
  },
  "last_update_date": "2024-11-23T19:26:08.366000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "libvncclient/rfbproto: limit max textchat size",
        "trust": 0.8,
        "url": "https://github.com/LibVNC/libvncserver/commit/8937203441ee241c4ace85da687b7d6633a12365"
      },
      {
        "title": "Comparing changes",
        "trust": 0.8,
        "url": "https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13"
      },
      {
        "title": "LibVNCServer Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=125166"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-770",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14405"
      },
      {
        "trust": 1.6,
        "url": "https://github.com/libvnc/libvncserver/compare/libvncserver-0.9.12...libvncserver-0.9.13"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html"
      },
      {
        "trust": 1.6,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
      },
      {
        "trust": 1.6,
        "url": "https://github.com/libvnc/libvncserver/commit/8937203441ee241c4ace85da687b7d6633a12365"
      },
      {
        "trust": 1.6,
        "url": "https://usn.ubuntu.com/4434-1/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14405"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2248/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2535/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/libvncserver-multiple-vulnerabilities-32651"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021052205"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/48926"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021121649"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1705"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/162682/red-hat-security-advisory-2021-1811-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158543/ubuntu-security-notice-usn-4434-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2972/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14397"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20839"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14397"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25708"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-21247"
      },
      {
        "trust": 0.1,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:1811"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-21247"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14405"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25708"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-20839"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14400"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4434-1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14402"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14398"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14401"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.5"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14396"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20840"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.2"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "db": "PACKETSTORM",
        "id": "158543"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "db": "PACKETSTORM",
        "id": "158543"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "date": "2021-05-19T14:14:14",
        "db": "PACKETSTORM",
        "id": "162682"
      },
      {
        "date": "2020-07-24T14:28:24",
        "db": "PACKETSTORM",
        "id": "158543"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2020-06-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "date": "2020-06-17T16:15:12.337000",
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2022-03-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      },
      {
        "date": "2024-11-21T05:03:12.007000",
        "db": "NVD",
        "id": "CVE-2020-14405"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "158543"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "LibVNCServer Vulnerability in resource allocation without restrictions or throttling in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-006690"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1184"
      }
    ],
    "trust": 1.2
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.