CVE-2018-20023

Priority
Description
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665:
Improper Initialization vulnerability in VNC Repeater client code that
allows attacker to read stack memory and can be abuse for information
disclosure. Combined with another vulnerability, it can be used to leak
stack memory layout and in bypassing ASLR
Assigned-to
mdeslaur
Notes
Package
Source: italc (LP Ubuntu Debian)
Upstream:released (1:3.0.3+dfsg1-1+deb9u1, 1:2.0.2+dfsg1-2+deb8u1)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was needed)
Ubuntu 16.04 LTS (Xenial Xerus):released (1:2.0.2+dfsg1-4ubuntu0.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (1:3.0.3+dfsg1-3ubuntu0.1)
Ubuntu 20.04 LTS (Focal Fossa):DNE
Ubuntu 20.10 (Groovy Gorilla):DNE
Package
Upstream:released (0.9.11+dfsg-1.2)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was released [0.9.9+dfsg-1ubuntu1.4])
Ubuntu 16.04 LTS (Xenial Xerus):released (0.9.10+dfsg-3ubuntu0.16.04.3)
Ubuntu 18.04 LTS (Bionic Beaver):released (0.9.11+dfsg-1ubuntu1.1)
Ubuntu 20.04 LTS (Focal Fossa):not-affected (0.9.11+dfsg-1.2)
Ubuntu 20.10 (Groovy Gorilla):not-affected (0.9.11+dfsg-1.2)
Patches:
Upstream:https://github.com/LibVNC/libvncserver/commit/8b06f835e259652b0ff026898014fc7297ade858
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):not-affected (uses shared libvnc)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (uses shared libvnc)
Ubuntu 18.04 LTS (Bionic Beaver):not-affected (uses shared libvnc)
Ubuntu 20.04 LTS (Focal Fossa):not-affected (uses shared libvnc)
Ubuntu 20.10 (Groovy Gorilla):not-affected (uses shared libvnc)
More Information

Updated: 2020-10-13 18:15:26 UTC (commit 5bf85da81b9d3ec049ebb32fc4b7f546710e65c3)