Lucene search

[email protected]CVE-2018-20023

HistoryDec 19, 2018 - 4:29 p.m.

CVE-2018-20023

2018-12-1916:29:00

CWE-665

[email protected]

web.nvd.nist.gov

122

libvnc

cve-2018-20023

cwe-665

vnc repeater

improper initialization

stack memory

information disclosure

aslr bypass

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.9 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.8%

JSON

LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR

Affected configurations

NVD

Node

libvnc_projectlibvncserverRange<0.9.12

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch16.04lts

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch18.10

CPENameOperatorVersion
libvnc_project:libvncserverlibvnc project libvncserverlt0.9.12

CPE	Name	Operator	Version
libvnc_project:libvncserver	libvnc project libvncserver	lt	0.9.12

CNA Affected

[
  {
    "product": "LibVNC",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "commit 8b06f835e259652b0ff026898014fc7297ade858"
      }
    ]
  }
]