Kaspersky Lab discovered several vulnerabilities in libvncserver, a C library to implement VNC server/client functionalities.

CVE-2018-6307

a heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity.

CVE-2018-15127

contains a heap out-of-bound write vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity.

CVE-2018-20019

multiple heap out-of-bound write vulnerabilities in VNC client code, which can result in remote code execution.

CVE-2018-20020

heap out-of-bound write vulnerability in a structure in VNC client code, which can result in remote code execution.

CVE-2018-20021

CWE-835: Infinite Loop vulnerability in VNC client code. The vulnerability could allow an attacker to consume an excessive amount of resources, such as CPU and RAM.

CVE-2018-20022

CWE-665: Improper Initialization weaknesses in VNC client code, which could allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR.

CVE-2018-20023

Improper Initialization vulnerability in VNC Repeater client code, which could allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR.

CVE-2018-20024

a NULL pointer dereference in VNC client code, which can result in DoS.

For Debian 8 'Jessie', these problems have been fixed in version 0.9.9+dfsg2-6.1+deb8u4.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

Security issues fixed :

CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)

CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)

CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)

CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)

CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)

CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)

CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)

CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pavel Cheremushkin discovered several vulnerabilities in libvncserver, a library to implement VNC server/client functionalities, which might result in the execution of arbitrary code, denial of service or information disclosure.

Several vulnerabilities have been identified in the VNC code of ssvnc, an encryption-capable VNC client..

The vulnerabilities referenced below are issues that have originally been reported against Debian source package libvncserver (which also ships the libvncclient shared library). The ssvnc source package in Debian ships a custom-patched, stripped down and outdated variant of libvncclient, thus some of libvncclient's security fixes required porting over.

CVE-2018-20020

LibVNC contained heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution

CVE-2018-20021

LibVNC contained a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM

CVE-2018-20022

LibVNC contained multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allowed attackers to read stack memory and could be abused for information disclosure. Combined with another vulnerability, it could be used to leak stack memory layout and in bypassing ASLR.

CVE-2018-20024

LibVNC contained NULL pointer dereference in VNC client code that could result DoS.

For Debian 8 'Jessie', these problems have been fixed in version 1.0.29-2+deb8u1.

We recommend that you upgrade your ssvnc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop     vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources     like CPU and RAM (CVE-2018-20021)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119877	Debian DLA-1617-1 : libvncserver security update	Nessus	Debian Local Security Checks	2018/12/27	2021/1/11	critical
121160	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2019:13927-1)	Nessus	SuSE Local Security Checks	2019/1/14	2021/1/19	critical
121561	Debian DSA-4383-1 : libvncserver - security update	Nessus	Debian Local Security Checks	2019/2/4	2020/2/20	critical
131434	Debian DLA-2016-1 : ssvnc security update	Nessus	Debian Local Security Checks	2019/12/3	2021/1/11	critical
222326	Linux Distros Unpatched Vulnerability : CVE-2018-20021	Nessus	Misc.	2025/3/4	2026/4/28	high

检测

插件搜索

critical

critical

critical

critical

high