CVE-2017-18922

high-risk
Published 2020-06-30

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

Do I need to act?

~
4.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (15)

Libvncserver

Affected Vendors

Siemens Canonical Fedoraproject Opensuse Libvncserver Project

References (26)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
Mailing List http://www.openwall.com/lists/oss-security/2020/06/30/3
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1852356
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
Patch https://github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a84...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Patch https://usn.ubuntu.com/4407-1/
Mailing List https://www.openwall.com/lists/oss-security/2020/06/30/2
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
Mailing List http://www.openwall.com/lists/oss-security/2020/06/30/3
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1852356
and 6 more references
58
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 8/34 · Low
Exposure 18/34 · Moderate