var-202006-1845
Vulnerability from variot

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. LibVNCServer Is vulnerable to lack of entropy.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. 8) - aarch64, ppc64le, x86_64

  1. ========================================================================== Ubuntu Security Notice USN-4407-1 July 01, 2020

libvncserver vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 20.04 LTS
  • Ubuntu 19.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in LibVNCServer. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680)

It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)

It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. An attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2017-18922)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04 LTS: libvncclient1 0.9.12+dfsg-9ubuntu0.1 libvncserver1 0.9.12+dfsg-9ubuntu0.1

Ubuntu 19.10: libvncclient1 0.9.11+dfsg-1.3ubuntu0.1 libvncserver1 0.9.11+dfsg-1.3ubuntu0.1

Ubuntu 18.04 LTS: libvncclient1 0.9.11+dfsg-1ubuntu1.2 libvncserver1 0.9.11+dfsg-1ubuntu1.2

Ubuntu 16.04 LTS: libvncclient1 0.9.10+dfsg-3ubuntu0.16.04.4 libvncserver1 0.9.10+dfsg-3ubuntu0.16.04.4

After a standard system update you need to restart LibVNCServer to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: libvncserver security update Advisory ID: RHSA-2020:3281-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:3281 Issue date: 2020-08-03 CVE Names: CVE-2017-18922 ==================================================================== 1. Summary:

An update for libvncserver is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

  1. Description:

LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

Security Fix(es):

  • libvncserver: websocket decoding buffer overflow (CVE-2017-18922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

1852356 - CVE-2017-18922 libvncserver: websocket decoding buffer overflow

  1. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source: libvncserver-0.9.9-14.el7_8.1.src.rpm

x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source: libvncserver-0.9.9-14.el7_8.1.src.rpm

ppc64le: libvncserver-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm

x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64le: libvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm libvncserver-devel-0.9.9-14.el7_8.1.ppc64le.rpm

x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source: libvncserver-0.9.9-14.el7_8.1.src.rpm

x86_64: libvncserver-0.9.9-14.el7_8.1.i686.rpm libvncserver-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64: libvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm libvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm libvncserver-devel-0.9.9-14.el7_8.1.i686.rpm libvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2017-18922 https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIVAwUBXygVLdzjgjWX9erEAQjn5BAAmrE0XEfwDvLUYWQkFeamAij8uUnf12Z4 fJQmIn0PlNFlNJXtSChiqf0EKTk6cAuaGF+g2FBX1AeTDxqRmTZpvR8YFyw1GK0h OjScrrLyU4F0q+kgGS3S39bpBydUGaUefw+rB/Slg6NNT2+EEKHo6pogYrsJE7hP LlrrfTIGnfS3NOZj/co4Kx1MWG2EswZ0gJXlho4o7ZPuPZOWLLv3tqzoVl86UEhG XJtN1lWzW0jy/QRsN88/MWC+RXAEyTja37CHX+l+Se+RdN3G0BqoNEflnNxXtSZR 1b+0VWFhqV/R3djpB7c/geCV5OW1n9InMvmdkcnXIbfA8WIUNbNGxcEAHX7SsZ1C yPsu9CrEef5ZuXycTyeLNam6wYwZiaTOkNuui3yAzmyvZOkyPZHhCYgzI31Xy7Jy OkCgxVebn0sxxle6aq3lm3g1c09Fw7eLgKFE2WJnUElWSql1peD2WaAcXFFkhgNI M3drMJzvG0B0aR+qvtIQARnsKlkMxrgaVXRa3S3ZGlFigTwao2CSI/2xHEvx0QfT tw2oTKLjboVuwBwnEj2MltXKSvSnHKSExF5Y0EnIJnZRg1XzPGavnAwjVk1k3uSg yT9Db8jds1GXsWoVyqfflp5qUhIpfrtA50pagzIIGyqE9zjiyW+S8+YZdMwXtYa8 qgB/RwEdM5k=1gVa -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 8.1) - ppc64le, x86_64

3

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202006-1845",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "simatic itc2200",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "simatic itc1500 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "31"
      },
      {
        "model": "simatic itc2200 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1900 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "libvncserver",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "libvncserver",
        "version": "0.9.12"
      },
      {
        "model": "simatic itc2200",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.2"
      },
      {
        "model": "simatic itc1900",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "simatic itc1500",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "simatic itc2200 pro",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.0.0.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "20.04"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "19.10"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "32"
      },
      {
        "model": "simatic itc1900 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "simatic itc1500 pro",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1900",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "simatic itc1500",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "3.2.1.0"
      },
      {
        "model": "ubuntu",
        "scope": null,
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "fedora",
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "model": "libvncserver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "libvnc",
        "version": "0.9.12"
      },
      {
        "model": "leap",
        "scope": null,
        "trust": 0.8,
        "vendor": "opensuse",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:canonical:ubuntu_linux",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:fedoraproject:fedora",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:libvncserver_project:libvncserver",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:opensuse_project:leap",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "db": "PACKETSTORM",
        "id": "158880"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      }
    ],
    "trust": 1.0
  },
  "cve": "CVE-2017-18922",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-18922",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2017-015072",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-18922",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2017-015072",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-18922",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2017-015072",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202006-1844",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-18922",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. LibVNCServer Is vulnerable to lack of entropy.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. 8) - aarch64, ppc64le, x86_64\n\n3. ==========================================================================\nUbuntu Security Notice USN-4407-1\nJuly 01, 2020\n\nlibvncserver vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n- Ubuntu 19.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in LibVNCServer. An\nattacker could possibly use this issue to cause LibVNCServer to crash,\nresulting in a denial of service. (CVE-2019-15680)\n\nIt was discovered that an information disclosure vulnerability existed in\nLibVNCServer when sending a ServerCutText message. An attacker could\npossibly\nuse this issue to expose sensitive information. This issue only affected\nUbuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)\n\nIt was discovered that LibVNCServer incorrectly handled cursor shape\nupdates. \nIf a user were tricked in to connecting to a malicious server, an attacker\ncould possibly use this issue to cause LibVNCServer to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. An attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service, or possibly execute arbitrary code. \nThis issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu\n16.04 LTS. \n(CVE-2017-18922)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\nlibvncclient1 0.9.12+dfsg-9ubuntu0.1\nlibvncserver1 0.9.12+dfsg-9ubuntu0.1\n\nUbuntu 19.10:\nlibvncclient1 0.9.11+dfsg-1.3ubuntu0.1\nlibvncserver1 0.9.11+dfsg-1.3ubuntu0.1\n\nUbuntu 18.04 LTS:\nlibvncclient1 0.9.11+dfsg-1ubuntu1.2\nlibvncserver1 0.9.11+dfsg-1ubuntu1.2\n\nUbuntu 16.04 LTS:\nlibvncclient1 0.9.10+dfsg-3ubuntu0.16.04.4\nlibvncserver1 0.9.10+dfsg-3ubuntu0.16.04.4\n\nAfter a standard system update you need to restart LibVNCServer to make\nall the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: libvncserver security update\nAdvisory ID:       RHSA-2020:3281-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:3281\nIssue date:        2020-08-03\nCVE Names:         CVE-2017-18922\n====================================================================\n1. Summary:\n\nAn update for libvncserver is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nLibVNCServer is a C library that enables you to implement VNC server\nfunctionality into own programs. \n\nSecurity Fix(es):\n\n* libvncserver: websocket decoding buffer overflow (CVE-2017-18922)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1852356 - CVE-2017-18922 libvncserver: websocket decoding buffer overflow\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nlibvncserver-0.9.9-14.el7_8.1.src.rpm\n\nx86_64:\nlibvncserver-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nlibvncserver-0.9.9-14.el7_8.1.src.rpm\n\nppc64le:\nlibvncserver-0.9.9-14.el7_8.1.ppc64le.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm\n\nx86_64:\nlibvncserver-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64le:\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.ppc64le.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.ppc64le.rpm\n\nx86_64:\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nlibvncserver-0.9.9-14.el7_8.1.src.rpm\n\nx86_64:\nlibvncserver-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-debuginfo-0.9.9-14.el7_8.1.x86_64.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.i686.rpm\nlibvncserver-devel-0.9.9-14.el7_8.1.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-18922\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXygVLdzjgjWX9erEAQjn5BAAmrE0XEfwDvLUYWQkFeamAij8uUnf12Z4\nfJQmIn0PlNFlNJXtSChiqf0EKTk6cAuaGF+g2FBX1AeTDxqRmTZpvR8YFyw1GK0h\nOjScrrLyU4F0q+kgGS3S39bpBydUGaUefw+rB/Slg6NNT2+EEKHo6pogYrsJE7hP\nLlrrfTIGnfS3NOZj/co4Kx1MWG2EswZ0gJXlho4o7ZPuPZOWLLv3tqzoVl86UEhG\nXJtN1lWzW0jy/QRsN88/MWC+RXAEyTja37CHX+l+Se+RdN3G0BqoNEflnNxXtSZR\n1b+0VWFhqV/R3djpB7c/geCV5OW1n9InMvmdkcnXIbfA8WIUNbNGxcEAHX7SsZ1C\nyPsu9CrEef5ZuXycTyeLNam6wYwZiaTOkNuui3yAzmyvZOkyPZHhCYgzI31Xy7Jy\nOkCgxVebn0sxxle6aq3lm3g1c09Fw7eLgKFE2WJnUElWSql1peD2WaAcXFFkhgNI\nM3drMJzvG0B0aR+qvtIQARnsKlkMxrgaVXRa3S3ZGlFigTwao2CSI/2xHEvx0QfT\ntw2oTKLjboVuwBwnEj2MltXKSvSnHKSExF5Y0EnIJnZRg1XzPGavnAwjVk1k3uSg\nyT9Db8jds1GXsWoVyqfflp5qUhIpfrtA50pagzIIGyqE9zjiyW+S8+YZdMwXtYa8\nqgB/RwEdM5k=1gVa\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. 8.1) - ppc64le, x86_64\n\n3",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "db": "PACKETSTORM",
        "id": "158281"
      },
      {
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "db": "PACKETSTORM",
        "id": "158880"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-18922",
        "trust": 3.0
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2020/06/30/2",
        "trust": 1.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2020/06/30/3",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-390195",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "159024",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158809",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158281",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158725",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "158880",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2831",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2727",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2657",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2469",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2746",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3000",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-350-12",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021121649",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-18922",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "db": "PACKETSTORM",
        "id": "158281"
      },
      {
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "db": "PACKETSTORM",
        "id": "158880"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "id": "VAR-202006-1845",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.33603895
  },
  "last_update_date": "2024-11-23T20:31:20.075000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "FEDORA-2020-37112ac660",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/"
      },
      {
        "title": "fix overflow and refactor websockets decode (Hybi)",
        "trust": 0.8,
        "url": "https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433"
      },
      {
        "title": "openSUSE-SU-2020:0960-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html"
      },
      {
        "title": "openSUSE-SU-2020:0978-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html"
      },
      {
        "title": "openSUSE-SU-2020:0988-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
      },
      {
        "title": "openSUSE-SU-2020:1025-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
      },
      {
        "title": "openSUSE-SU-2020:1056-1",
        "trust": 0.8,
        "url": "https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
      },
      {
        "title": "USN-4407-1",
        "trust": 0.8,
        "url": "https://ubuntu.com/security/notices/USN-4407-1"
      },
      {
        "title": "LibVNCServer Buffer error vulnerability fix",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122803"
      },
      {
        "title": "Red Hat: Important: libvncserver security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203588 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: libvncserver security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203385 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: libvncserver security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203281 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: libvncserver security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20203456 - Security Advisory"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18922"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.openwall.com/lists/oss-security/2020/06/30/3"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1852356"
      },
      {
        "trust": 1.7,
        "url": "https://github.com/libvnc/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433"
      },
      {
        "trust": 1.7,
        "url": "https://usn.ubuntu.com/4407-1/"
      },
      {
        "trust": 1.7,
        "url": "https://www.openwall.com/lists/oss-security/2020/06/30/2"
      },
      {
        "trust": 1.6,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4f6fuh4efk4nap6gt4tqrtbkwirczliy/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nvp7tjvyjdxdfrhvq3enen3h354qpxez/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18922"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4f6fuh4efk4nap6gt4tqrtbkwirczliy/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nvp7tjvyjdxdfrhvq3enen3h354qpxez/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158880/red-hat-security-advisory-2020-3456-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158725/red-hat-security-advisory-2020-3281-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2469/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158809/red-hat-security-advisory-2020-3385-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2831/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2657/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2746/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/159024/red-hat-security-advisory-2020-3588-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2727/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/libvncserver-buffer-overflow-via-websockets-c-32696"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021121649"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-350-12"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3000/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/158281/ubuntu-security-notice-usn-4407-1.html"
      },
      {
        "trust": 0.4,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2017-18922"
      },
      {
        "trust": 0.4,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/errata/rhsa-2020:3588"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/787.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184357"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3385"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4407-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.10+dfsg-3ubuntu0.16.04.4"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1ubuntu1.2"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15681"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15680"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.12+dfsg-9ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/libvncserver/0.9.11+dfsg-1.3ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20788"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3281"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3456"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "db": "PACKETSTORM",
        "id": "158281"
      },
      {
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "db": "PACKETSTORM",
        "id": "158880"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "db": "PACKETSTORM",
        "id": "158281"
      },
      {
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "db": "PACKETSTORM",
        "id": "158880"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-06-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "date": "2020-08-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "date": "2020-09-01T15:38:29",
        "db": "PACKETSTORM",
        "id": "159024"
      },
      {
        "date": "2020-08-10T14:27:27",
        "db": "PACKETSTORM",
        "id": "158809"
      },
      {
        "date": "2020-07-02T15:43:16",
        "db": "PACKETSTORM",
        "id": "158281"
      },
      {
        "date": "2020-08-03T17:15:01",
        "db": "PACKETSTORM",
        "id": "158725"
      },
      {
        "date": "2020-08-17T15:35:31",
        "db": "PACKETSTORM",
        "id": "158880"
      },
      {
        "date": "2020-06-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "date": "2020-06-30T11:15:10.380000",
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-18922"
      },
      {
        "date": "2020-08-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      },
      {
        "date": "2021-12-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      },
      {
        "date": "2024-11-21T03:21:16.067000",
        "db": "NVD",
        "id": "CVE-2017-18922"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "LibVNCServer Vulnerability regarding lack of entropy in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-015072"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202006-1844"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.