PT-2018-3545 · Libvncserver+6 · Libvncserver+6

Pavel Cheremushkin · Publicado 2018-09-11 · Atualizado 2022-03-10 · CVE-2018-21247

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LibVNCServer versions prior to 0.9.13

Description: The issue is related to the implementation of the ConnectToRFBRepeater function in the LibVNCServer library, which lacks protection of service data. This can lead to an information leak of uninitialized memory contents. Exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations: For versions prior to 0.9.13, update to version 0.9.13 or later to resolve the issue. As a temporary workaround, consider disabling the ConnectToRFBRepeater function until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-909

CWE-200

Identificadores relacionados

ALSA-2021:1811

ALT-PU-2020-2671

ALT-PU-2020-2694

BDU:2020-03958

CESA-2021_1811

CVE-2018-21247

DLA-1617-1

DSA-4383-1

OPENSUSE-SU-2020:0988-1

OPENSUSE-SU-2020:1025-1

OPENSUSE-SU-2020:1056-1

OPENSUSE-SU-2020_0988-1

OPENSUSE-SU-2020_1025-1

OPENSUSE-SU-2020_1056-1

OPENSUSE-SU-2024:10598-1

RHSA-2021:1811

RHSA-2021_1811

RLSA-2021:1811

SUSE-SU-2020:1922-1

SUSE-SU-2020:2167-1

Produtos afetados

Alt Linux

Almalinux

Centos

Libvncserver

Red Hat

Rocky Linux

Suse

Referências · 71

• https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13 · Correção
• https://github.com/LibVNC/libvncserver/issues/253 · Nota
• https://github.com/LibVNC/libvncserver/issues/253%20Issue%20Tracking%20%20Third%20Party%20Advisory · Nota
• https://bugzilla.suse.com/1173880 · Nota
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://vulners.com/cve/CVE-2020-14397 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY · Aviso do Fabricante
• https://bugzilla.suse.com/1173700 · Nota
• https://errata.almalinux.org/8/ALSA-2021-1811.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-20839 · Nota
• https://suse.com/support/update/announcement/2020/suse-su-20201922-1 · Nota
• https://suse.com/security/cve/CVE-2020-14398 · Nota
• https://osv.dev/vulnerability/RLSA-2021:1811 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALSA-2021:1811 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-14403 · Nota