CVE-2018-20023
Fixed in a distro release EPSS 2%
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR
Products: libvnc_project libvncserver, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libvncserver | 0.9.11+dfsg-1.2 |
| Debian 12 | veyon | 4.1.4+repack1-1 |
| Debian 13 | libvncserver | 0.9.11+dfsg-1.2 |
| Debian 13 | veyon | 4.1.4+repack1-1 |
| Debian 14 | libvncserver | 0.9.11+dfsg-1.2 |
| Debian 8 | italc | 1:2.0.2+dfsg1-2+deb8u1 |
| Debian 8 | libvncserver | 0.9.9+dfsg2-6.1+deb8u4 |
| Debian 9 | libvncserver | 0.9.11+dfsg-1.3~deb9u1 |
| SUSE Enterprise Storage 4 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Module for Package Hub 15 | LibVNCServer | 0.9.10-4.3.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server 12 SP3 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server 12 SP4 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server 12-LTSS | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | LibVNCServer | 0.9.9-17.8.1 |
| SUSE Linux Enterprise Workstation Extension 15 | LibVNCServer | 0.9.10-4.3.1 |
| SUSE OpenStack Cloud 7 | LibVNCServer | 0.9.9-17.8.1 |
| Ubuntu 14.04 LTS | libvncserver | 0.9.9+dfsg-1ubuntu1.4 |
| Ubuntu 16.04 LTS | italc | 1:2.0.2+dfsg1-4ubuntu0.1 |
| Ubuntu 16.04 LTS | libvncserver | 0.9.10+dfsg-3ubuntu0.16.04.3 |
| Ubuntu 18.04 LTS | italc | 1:3.0.3+dfsg1-3ubuntu0.1 |
| Ubuntu 18.04 LTS | libvncserver | 0.9.11+dfsg-1ubuntu1.1 |
| openSUSE Leap 15.0 | LibVNCServer | 0.9.10-lp150.3.3.1 |