HIGH
libvncserver: Infinite loop in VNC client code allows for denial of service
Published Dec 19, 2018
7.5
HIGHCVSS 3.0
EPSS 3.52%
Description
LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM
Affected products
- Vendor n/a Product LibVNC Defaultn/a
- Version commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19cStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | LibVNC | n/a |
|
Configuration 1
- < 0.9.12
Configuration 2
OR
- 14.04
- 16.04
- 18.04
- 18.10
- 8.0
- 9.0
No data.
Red Hat Enterprise Linux 6
libvncserver
Not affected
Red Hat Enterprise Linux 7
libvncserver
Not affected
Red Hat Enterprise Linux 8
libvncserver
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | libvncserver | Not affected | n/a |
| Red Hat Enterprise Linux 7 | libvncserver | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libvncserver | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (16)
- https://access.redhat.com/security/cve/CVE-2018-20021 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1661120 Issue Tracking
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-031-libvnc-infinite-loop/ x_refsource_MISCThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html mailing-listx_refsource_MLIST
- https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html mailing-listx_refsource_MLIST
- https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2018-20021
- https://security.gentoo.org/glsa/201908-05 vendor-advisoryx_refsource_GENTOO
- https://security.gentoo.org/glsa/202006-06 vendor-advisoryx_refsource_GENTOO
- https://usn.ubuntu.com/3877-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/4547-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4547-2/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4587-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2018-20021
- https://www.debian.org/security/2019/dsa-4383 vendor-advisoryx_refsource_DEBIANThird Party Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Kaspersky
Published Dec 19, 2018
Updated Aug 5, 2024
Reserved Dec 10, 2018
Link CVE-2018-20021
CISA Vulnrichment
Updated n/a