CVE-2018-20020
CVE-2018-20020
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution
CVSS 9.8 · Critical · EPSS 8.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libvnc
- Versions
- commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d: Affected
No fix published
libvncserver Debian:12
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1.2
Update to 0.9.11+dfsg-1.2
libvncserver Debian:13
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1.2
Update to 0.9.11+dfsg-1.2
libvncserver Debian:14
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1.2
Update to 0.9.11+dfsg-1.2
ssvnc Debian:12
- Affected ranges
- ECOSYSTEM: < 1.0.29-5
Update to 1.0.29-5
ssvnc Debian:13
- Affected ranges
- ECOSYSTEM: < 1.0.29-5
Update to 1.0.29-5
ssvnc Debian:14
- Affected ranges
- ECOSYSTEM: < 1.0.29-5
Update to 1.0.29-5
veyon Debian:12
- Affected ranges
- ECOSYSTEM: < 4.1.4+repack1-1
Update to 4.1.4+repack1-1
veyon Debian:13
- Affected ranges
- ECOSYSTEM: < 4.1.4+repack1-1
Update to 4.1.4+repack1-1
libvncserver Ubuntu:14.04:LTS
- Versions
- 0.9.9+dfsg-1
- 0.9.9+dfsg-1ubuntu1
- 0.9.9+dfsg-1ubuntu1.1
- 0.9.9+dfsg-1ubuntu1.2
- 0.9.9+dfsg-1ubuntu1.3
- Affected ranges
- ECOSYSTEM: < 0.9.9+dfsg-1ubuntu1.4
Update to 0.9.9+dfsg-1ubuntu1.4
tightvnc Ubuntu:Pro:14.04:LTS
- Versions
- 1.3.9-6.4
- 1.3.9-6.4ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.3.9-6.5+deb8u1build0.14.04.1~esm1
Update to 1.3.9-6.5+deb8u1build0.14.04.1~esm1
italc Ubuntu:16.04:LTS
- Versions
- 1:2.0.2+dfsg1-3
- 1:2.0.2+dfsg1-4
- Affected ranges
- ECOSYSTEM: < 1:2.0.2+dfsg1-4ubuntu0.1
Update to 1:2.0.2+dfsg1-4ubuntu0.1
libvncserver Ubuntu:16.04:LTS
- Versions
- 0.9.10+dfsg-3
- 0.9.10+dfsg-3build1
- 0.9.10+dfsg-3ubuntu0.16.04.1
- 0.9.10+dfsg-3ubuntu0.16.04.2
- Affected ranges
- ECOSYSTEM: < 0.9.10+dfsg-3ubuntu0.16.04.3
Update to 0.9.10+dfsg-3ubuntu0.16.04.3
ssvnc Ubuntu:16.04:LTS
- Versions
- 1.0.29-2build1
- Affected ranges
- ECOSYSTEM: < 1.0.29-2+deb8u1build0.16.04.1
Update to 1.0.29-2+deb8u1build0.16.04.1
tightvnc Ubuntu:16.04:LTS
- Versions
- 1.3.10-0ubuntu2
- 1.3.10-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
italc Ubuntu:18.04:LTS
- Versions
- 1:3.0.3+dfsg1-1
- 1:3.0.3+dfsg1-2
- 1:3.0.3+dfsg1-2build1
- 1:3.0.3+dfsg1-2ubuntu1
- 1:3.0.3+dfsg1-3
- Affected ranges
- ECOSYSTEM: < 1:3.0.3+dfsg1-3ubuntu0.1
Update to 1:3.0.3+dfsg1-3ubuntu0.1
libvncserver Ubuntu:18.04:LTS
- Versions
- 0.9.11+dfsg-1
- 0.9.11+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1ubuntu1.1
Update to 0.9.11+dfsg-1ubuntu1.1
ssvnc Ubuntu:18.04:LTS
- Versions
- 1.0.29-3
- 1.0.29-3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:18.04:LTS
- Versions
- 1.3.10-0ubuntu3
- 1.3.10-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:20.04:LTS
- Versions
- 1.3.10-0ubuntu5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:22.04:LTS
- Versions
- 1:1.3.10-3
- 1:1.3.10-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:24.04:LTS
- Versions
- 1:1.3.10-7
- 1:1.3.10-7build1
- 1:1.3.10-7build2
- 1:1.3.10-8
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:25.10
- Versions
- 1:1.3.10-9
- 1:1.3.10-10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tightvnc Ubuntu:26.10
- Versions
- 1:1.3.10-10build1
- 1:1.3.10-11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.debian.org/security/2019/dsa-4383
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html
- https://usn.ubuntu.com/3877-1/
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/
- https://security.gentoo.org/glsa/201908-05
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html
- https://security.gentoo.org/glsa/202006-06
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4547-2/
- https://usn.ubuntu.com/4587-1/
- https://nvd.nist.gov/vuln/detail/CVE-2018-20020