CVE-2018-20024 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Kaspersky	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 85%

Vendor	Product	Version
libvnc_project	libvncserver	𝑥 < 0.9.12
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	18.10
debian	debian_linux	8.0
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libvncserver

bullseye	0.9.13+dfsg-2+deb11u1 fixed
bookworm	0.9.14+dfsg-1 fixed
sid	0.9.14+dfsg-1 fixed
trixie	0.9.14+dfsg-1 fixed

ssvnc

bullseye	1.0.29-5 fixed
bookworm	1.0.29-6 fixed
sid	1.0.29-6.1 fixed
trixie	1.0.29-6.1 fixed

veyon

bullseye	4.5.3+repack1-1 fixed
bookworm	4.7.5+repack1-1 fixed
sid	4.7.5+repack1-1.1 fixed

Ubuntu Releases

Ubuntu Product

Codename

italc

noble	dne
mantic	dne
lunar	dne
kinetic	dne
jammy	dne
impish	dne
hirsute	dne
groovy	dne
focal	dne
bionic	Fixed 1:3.0.3+dfsg1-3ubuntu0.1 released
xenial	Fixed 1:2.0.2+dfsg1-4ubuntu0.1 released
trusty	dne

libvncserver

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
disco	not-affected
cosmic	Fixed 0.9.11+dfsg-1.1ubuntu0.1 released
bionic	Fixed 0.9.11+dfsg-1ubuntu1.1 released
xenial	Fixed 0.9.10+dfsg-3ubuntu0.16.04.3 released
trusty	Fixed 0.9.9+dfsg-1ubuntu1.4 released

ssvnc

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
bionic	needed
xenial	Fixed 1.9.29-2+deb8u1build0.16.04.1 released
trusty	dne

x11vnc

noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
disco	not-affected
cosmic	ignored
bionic	not-affected
xenial	not-affected
trusty	not-affected

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-034-libvnc-null-pointer-dereference/

https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html

https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html

https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html

https://security.gentoo.org/glsa/201908-05

https://security.gentoo.org/glsa/202006-06

https://usn.ubuntu.com/3877-1/

https://usn.ubuntu.com/4547-1/

https://usn.ubuntu.com/4547-2/

https://usn.ubuntu.com/4587-1/

https://www.debian.org/security/2019/dsa-4383

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-034-libvnc-null-pointer-dereference/

https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html

https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html

https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html

https://security.gentoo.org/glsa/201908-05

https://security.gentoo.org/glsa/202006-06

https://usn.ubuntu.com/3877-1/

https://usn.ubuntu.com/4547-1/

https://usn.ubuntu.com/4547-2/

https://usn.ubuntu.com/4587-1/

https://www.debian.org/security/2019/dsa-4383