VDB

CVE-2018-20022

CVE-2018-20022 PUBLISHED CVSS 7.5 HIGH

LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR

EPSS 2.94% · 86.6th percentile

Risk Scores

CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
2.94%
86.6th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSlibvncserver0.9.9+dfsg-1ubuntu1, 0, *
Ubuntu:18.04:LTSitalc1:3.0.3+dfsg1-2build1, *, *
Ubuntu:16.04:LTSlibvncserver0.9.10+dfsg-3ubuntu0.16.04.2, 0.9.10+dfsg-3, 0
Ubuntu:16.04:LTStightvnc1.3.10-0ubuntu2, 1.3.10-0ubuntu3, 0
Ubuntu:16.04:LTSitalc1:2.0.2+dfsg1-3, *, 0
Ubuntu:25.10tightvnc0, 1:1.3.10-9, 1:1.3.10-10
Ubuntu:16.04:LTSssvnc0, 1.0.29-2build1
Ubuntu:18.04:LTSssvnc1.0.29-3, 0, 1.0.29-3build1
Ubuntu:18.04:LTSlibvncserver0, 0.9.11+dfsg-1, 0.9.11+dfsg-1ubuntu1
Ubuntu:Pro:14.04:LTStightvnc1.3.9-6.4, 1.3.9-6.4ubuntu1, 0
Ubuntu:18.04:LTStightvnc0, 1.3.10-0ubuntu3, 1.3.10-0ubuntu4
Ubuntu:22.04:LTStightvnc0, 1:1.3.10-3, *
Ubuntu:20.04:LTStightvnc1.3.10-0ubuntu5, 0
Ubuntu:24.04:LTStightvnc*, 1:1.3.10-7build1, 1:1.3.10-8

Timeline

  • Dec 19, 2018 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 27, 2021 EPSS Score
  • Dec 29, 2021 EPSS Score
  • Mar 2, 2022 EPSS Score
  • May 4, 2022 EPSS Score
  • Sep 8, 2022 EPSS Score
  • Nov 10, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 16, 2023 EPSS Score
  • May 18, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›