Vulnerability Description
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libvnc Project | Libvncserver | < 0.9.12 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://security.gentoo.org/glsa/201908-05
- https://usn.ubuntu.com/3877-1/Third Party Advisory
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4587-1/
- https://www.debian.org/security/2019/dsa-4383Third Party Advisory
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
- https://security.gentoo.org/glsa/201908-05
- https://usn.ubuntu.com/3877-1/Third Party Advisory
- https://usn.ubuntu.com/4547-1/
- https://usn.ubuntu.com/4587-1/
FAQ
What is CVE-2018-20023?
CVE-2018-20023 is a vulnerability with a CVSS score of 7.5 (HIGH). LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse fo...
How severe is CVE-2018-20023?
CVE-2018-20023 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-20023?
Check the references section above for vendor advisories and patch information. Affected products include: Libvnc Project Libvncserver, Debian Debian Linux, Canonical Ubuntu Linux.