Summary
It was discovered that LibVNCServer incorrectly handled certain operations.
A remote attacker able to connect to applications using LibVNCServer could
possibly use this issue to obtain sensitive information, cause a denial of
service, or execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | libvncserver | 0.9.9+dfsg-1ubuntu1.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | libvncserver | 0.9.10+dfsg-3ubuntu0.16.04.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | libvncserver | 0.9.11+dfsg-1ubuntu1.1 |
Vulnerabilities 12
-
Unscored —CVE-2018-15126 EPSS 12%
LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code…
-
Unscored —CVE-2018-15127 EPSS 15%
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server …
-
Unscored —
LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities…
-
Unscored —
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside str…
-
Unscored —
LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC cl…
-
Unscored —
LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vu…
-
Unscored —
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC R…
-
Unscored —
LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that…
-
Unscored —
LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for…
-
Unscored —
LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-201…
-
Unscored —
LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-20…
-
Unscored —CVE-2018-6307 EPSS 27%
LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code…
References
-
report
https://ubuntu.com/security/CVE-2018-6307
-
report
https://ubuntu.com/security/CVE-2018-15126
-
report
https://ubuntu.com/security/CVE-2018-15127
-
report
https://ubuntu.com/security/CVE-2018-20019
-
report
https://ubuntu.com/security/CVE-2018-20020
-
report
https://ubuntu.com/security/CVE-2018-20021
-
report
https://ubuntu.com/security/CVE-2018-20022
-
report
https://ubuntu.com/security/CVE-2018-20023
-
report
https://ubuntu.com/security/CVE-2018-20024
-
report
https://ubuntu.com/security/CVE-2018-20748
-
report
https://ubuntu.com/security/CVE-2018-20749
-
report
https://ubuntu.com/security/CVE-2018-20750