It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libvncserver-devel | May 4, 2022 | Jun 30, 2020 |
| Centos_linux | — | Upgrade libvncserver-debugsourceUpgrade libvncserverUpgrade libvncserver-develUpgrade libvncserver-debuginfo | Aug 4, 2020 | Jun 30, 2020 |
| Debian | — | Upgrade libvncserver | Jul 30, 2024 | Jun 30, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvncserver | Feb 22, 2021 | Jun 30, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libvncserver | Jan 20, 2021 | Jun 30, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libvncserver | Feb 3, 2021 | Jun 30, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvncserver | Dec 15, 2020 | Jun 30, 2020 |
| Oracle_linux | — | Upgrade libvncserverUpgrade libvncserver-devel | Aug 5, 2020 | Feb 15, 2017 |
| Redhat_linux | — | Upgrade libvncserver-develUpgrade libvncserverUpgrade libvncserver-debugsourceUpgrade libvncserver-debuginfo | Aug 4, 2020 | Jun 30, 2020 |
| Suse | — | Upgrade libvncclient0Upgrade LibVNCServer-develUpgrade libvncserver0 | Jul 15, 2020 | Jun 30, 2020 |
| Ubuntu | — | Upgrade libvncserver1Upgrade libvncclient1 | Aug 5, 2020 | Jun 30, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub