GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2018-20020 (GCVE-0-2018-20020)

Vulnerability from cvelistv5 – Published: 2018-12-19 16:00 – Updated: 2024-08-05 11:51
VLAI
Summary
LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution
Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • Heap Out-of-Bound write
Assigner
References
URL Tags
https://www.debian.org/security/2019/dsa-4383 vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3877-1/ vendor-advisoryx_refsource_UBUNTU
https://ics-cert.kaspersky.com/advisories/klcert-… x_refsource_MISC
https://security.gentoo.org/glsa/201908-05 vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2019… mailing-listx_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2019… mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202006-06 vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/4547-1/ vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4547-2/ vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/4587-1/ vendor-advisoryx_refsource_UBUNTU
Impacted products
Vendor Product Version CPE status
n/a LibVNC Affected: commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d
Date Public
2018-12-19 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:18.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-4383",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4383"
          },
          {
            "name": "[debian-lts-announce] 20181227 [SECURITY] [DLA 1617-1] libvncserver security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html"
          },
          {
            "name": "USN-3877-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3877-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/"
          },
          {
            "name": "GLSA-201908-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201908-05"
          },
          {
            "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html"
          },
          {
            "name": "[debian-lts-announce] 20191129 [SECURITY] [DLA 2016-1] ssvnc security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html"
          },
          {
            "name": "GLSA-202006-06",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-06"
          },
          {
            "name": "USN-4547-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4547-1/"
          },
          {
            "name": "USN-4547-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4547-2/"
          },
          {
            "name": "USN-4587-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4587-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LibVNC",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d"
            }
          ]
        }
      ],
      "datePublic": "2018-12-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Heap Out-of-Bound write",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-23T12:06:19.000Z",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "name": "DSA-4383",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4383"
        },
        {
          "name": "[debian-lts-announce] 20181227 [SECURITY] [DLA 1617-1] libvncserver security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html"
        },
        {
          "name": "USN-3877-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3877-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/"
        },
        {
          "name": "GLSA-201908-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201908-05"
        },
        {
          "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html"
        },
        {
          "name": "[debian-lts-announce] 20191129 [SECURITY] [DLA 2016-1] ssvnc security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html"
        },
        {
          "name": "GLSA-202006-06",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-06"
        },
        {
          "name": "USN-4547-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4547-1/"
        },
        {
          "name": "USN-4547-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4547-2/"
        },
        {
          "name": "USN-4587-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4587-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerability@kaspersky.com",
          "ID": "CVE-2018-20020",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "LibVNC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Heap Out-of-Bound write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-4383",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4383"
            },
            {
              "name": "[debian-lts-announce] 20181227 [SECURITY] [DLA 1617-1] libvncserver security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html"
            },
            {
              "name": "USN-3877-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3877-1/"
            },
            {
              "name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/",
              "refsource": "MISC",
              "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/"
            },
            {
              "name": "GLSA-201908-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201908-05"
            },
            {
              "name": "[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html"
            },
            {
              "name": "[debian-lts-announce] 20191129 [SECURITY] [DLA 2016-1] ssvnc security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html"
            },
            {
              "name": "GLSA-202006-06",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-06"
            },
            {
              "name": "USN-4547-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4547-1/"
            },
            {
              "name": "USN-4547-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4547-2/"
            },
            {
              "name": "USN-4587-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4587-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2018-20020",
    "datePublished": "2018-12-19T16:00:00.000Z",
    "dateReserved": "2018-12-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:51:18.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-20020",
      "date": "2026-09-14",
      "epss": "0.08622",
      "percentile": "0.94788"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.9.12\", \"matchCriteriaId\": \"DEF1BF44-78B8-44E3-9A5A-29AB8111322B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"B5A6F2F3-4894-4392-8296-3B8DD2679084\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07C312A0-CD2C-4B9C-B064-6409B25C278F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution\"}, {\"lang\": \"es\", \"value\": \"LibVNC antes del commit con ID 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contiene una vulnerabilidad de escritura de memoria din\\u00e1mica (heap) fuera de l\\u00edmites en la estructura del c\\u00f3digo del cliente VNC que puede resultar en la ejecuci\\u00f3n remota de c\\u00f3digo.\"}]",
      "id": "CVE-2018-20020",
      "lastModified": "2024-11-21T04:00:46.163",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2018-12-19T16:29:00.373",
      "references": "[{\"url\": \"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/\", \"source\": \"vulnerability@kaspersky.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html\", \"source\": \"vulnerability@kaspersky.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://security.gentoo.org/glsa/201908-05\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://security.gentoo.org/glsa/202006-06\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://usn.ubuntu.com/3877-1/\", \"source\": \"vulnerability@kaspersky.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4547-1/\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://usn.ubuntu.com/4547-2/\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://usn.ubuntu.com/4587-1/\", \"source\": \"vulnerability@kaspersky.com\"}, {\"url\": \"https://www.debian.org/security/2019/dsa-4383\", \"source\": \"vulnerability@kaspersky.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201908-05\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202006-06\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://usn.ubuntu.com/3877-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4547-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://usn.ubuntu.com/4547-2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://usn.ubuntu.com/4587-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2019/dsa-4383\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "vulnerability@kaspersky.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-20020\",\"sourceIdentifier\":\"vulnerability@kaspersky.com\",\"published\":\"2018-12-19T16:29:00.373\",\"lastModified\":\"2024-11-21T04:00:46.163\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LibVNC before commit 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap out-of-bound write vulnerability inside structure in VNC client code that can result remote code execution\"},{\"lang\":\"es\",\"value\":\"LibVNC antes del commit con ID 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contiene una vulnerabilidad de escritura de memoria din\u00e1mica (heap) fuera de l\u00edmites en la estructura del c\u00f3digo del cliente VNC que puede resultar en la ejecuci\u00f3n remota de c\u00f3digo.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.9.12\",\"matchCriteriaId\":\"DEF1BF44-78B8-44E3-9A5A-29AB8111322B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}],\"references\":[{\"url\":\"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/\",\"source\":\"vulnerability@kaspersky.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html\",\"source\":\"vulnerability@kaspersky.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://security.gentoo.org/glsa/201908-05\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://security.gentoo.org/glsa/202006-06\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://usn.ubuntu.com/3877-1/\",\"source\":\"vulnerability@kaspersky.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4547-1/\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://usn.ubuntu.com/4547-2/\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://usn.ubuntu.com/4587-1/\",\"source\":\"vulnerability@kaspersky.com\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4383\",\"source\":\"vulnerability@kaspersky.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/11/msg00033.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201908-05\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202006-06\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/3877-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4547-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4547-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4587-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4383\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T16:08:22+00:00",
      "cve": "CVE-2018-20020",
      "id": "CVE-2018-20020",
      "initial_release_date": "2018-12-19T00:00:00+00:00",
      "product_status:known_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libvncserver: Heap out-of-bound write inside structure in VNC client code allows for potential code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20020.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-22T02:33:46Z",
      "cve": "CVE-2018-20020",
      "id": "CVE-2018-20020",
      "initial_release_date": "2023-02-15T04:21:31Z",
      "product_status:known_affected": "41",
      "product_status:recommended": "131",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2018-20020",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2018-20020.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.