Vulnerability in Libvnc Project Libvncserver
CVE-2018-20022
LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR
Vulnerability class: Dirty Pipe (CVE-2022-0847)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.029 (86.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Libvnc Project Libvncserver
- Canonical Ubuntu Linux — versions 14.04, 16.04, 18.04
- Debian Linux — versions 8.0, 9.0
- Libvnc — versions commit 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838
Weakness classification (CWE)
References
- www.debian.org/security/2019/dsa-4383 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2018/12/msg00017.html (mailing-list, Mailing List, Third Party Advisory)
- ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-032-li… (Third Party Advisory)
- usn.ubuntu.com/3877-1/ (vendor-advisory, Third Party Advisory)
- security.gentoo.org/glsa/201908-05 (vendor-advisory)
- lists.debian.org/debian-lts-announce/2019/10/msg00042.html (mailing-list)
- lists.debian.org/debian-lts-announce/2019/11/msg00033.html (mailing-list)
- lists.debian.org/debian-lts-announce/2019/12/msg00028.html (mailing-list)
- security.gentoo.org/glsa/202006-06 (vendor-advisory)
- usn.ubuntu.com/4547-1/ (vendor-advisory)
Frequently asked questions
- What is CVE-2018-20022?
- CVE-2018-20022 is a high-severity vulnerability in Libvnc Project Libvncserver, classified under Improper Initialization. CVSS score: 7.5/10. Published 2018-12-19.
- How severe is CVE-2018-20022?
- High severity. CVSS v3 base score is 7.5 out of 10.