Vulnerability Description
LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libvnc Project | Libvncserver | < 0.9.12 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
- https://security.gentoo.org/glsa/201908-05
- https://security.gentoo.org/glsa/202006-06
- https://usn.ubuntu.com/3877-1/Third Party Advisory
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4547-2/
- https://usn.ubuntu.com/4587-1/
- https://www.debian.org/security/2019/dsa-4383Third Party Advisory
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
FAQ
What is CVE-2018-20022?
CVE-2018-20022 is a vulnerability with a CVSS score of 7.5 (HIGH). LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can ...
How severe is CVE-2018-20022?
CVE-2018-20022 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20022?
Check the references section above for vendor advisories and patch information. Affected products include: Libvnc Project Libvncserver, Debian Debian Linux, Canonical Ubuntu Linux.