An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference. Upstream commit: https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0
Created libvncserver tracking bugs for this issue: Affects: epel-7 [bug 1860346] Affects: fedora-all [bug 1860345]
libvncserver/rfbregion.c's sraSpanInsertAfter(), sraSpanInsertBefore(), sraSpanRemove() and libvncserver/rfbserver.c's rfbClientIteratorNext(), and rfbReleaseClientIterator() are missing NULL checks for sraSpan * and rfbClientIteratorPtr parameters. If one of them is NULL, this could cause a crash.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14397
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1811 https://access.redhat.com/errata/RHSA-2021:1811