PT-2017-3956 · Libvncserver Team+8 · Libvncserver+8
Published
2017-02-15
·
Updated
2022-04-01
·
CVE-2017-18922
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LibVNCServer versions prior to 0.9.12
Description
The issue is related to a buffer overflow in the websockets.c component of LibVNCServer. This can be exploited by a malicious attacker sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow. The exploitation of this issue may allow a remote attacker to cause a denial of service or execute arbitrary code.
Recommendations
For LibVNCServer versions prior to 0.9.12, update to version 0.9.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the websockets.c component until a patch is available. Avoid using the vulnerable component in the affected API endpoint until the issue is resolved.
Fix
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Libvncserver
Linuxmint
Red Hat
Suse
Ubuntu