Bug 1661128 (CVE-2018-20023) - CVE-2018-20023 libvncserver: Improper initialization in VNC Repeater client code allows for information disclosure
Summary: CVE-2018-20023 libvncserver: Improper initialization in VNC Repeater client c...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-20023
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1661129 1661130 1663002
Blocks: 1661105
TreeView+ depends on / blocked
 
Reported: 2018-12-20 07:18 UTC by Sam Fowler
Modified: 2021-02-16 22:37 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:44:25 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-12-20 07:18:20 UTC 
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR


External Reference:

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-033-libvnc-memory-leak/


Upstream Patch:

https://github.com/LibVNC/libvncserver/commit/8b06f835e259652b0ff026898014fc7297ade858
Comment 1 Sam Fowler 2018-12-20 07:18:35 UTC 
Created libvncserver tracking bugs for this issue:

Affects: epel-7 [bug 1661130]
Affects: fedora-all [bug 1661129]
Note You need to log in before you can comment on or make changes to this bug.