CVE-2017-18922: canonical ubuntu_linux Out-of-bounds Write
CVSS: 9.8v3.1CriticalModified
AliasesSUSE-SU-2020:1873-1RHSA-2020:3281RHSA-2020:3385RHSA-2020:3456RHSA-2020:3588UBUNTU-CVE-2017-18922DEBIAN-CVE-2017-18922openSUSE-SU-2020:0960-1openSUSE-SU-2020:0978-1
Published 30-06-2020Last modified 05-08-2024
Vulnerability summary
CVE-2017-18922 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
2.26%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 30-06-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.26% on 18-09-2026
18-09-202618-10-2026
EPSS score2.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Siemens6 products
- simatic_itc1500_firmware≥ 3.0.0.0, < 3.2.1.0
- simatic_itc1500_pro_firmware≥ 3.0.0.0, < 3.2.1.0
- simatic_itc1900_firmware≥ 3.0.0.0, < 3.2.1.0
- simatic_itc1900_pro_firmware≥ 3.0.0.0, < 3.2.1.0
- simatic_itc2200_firmware≥ 3.0.0.0, < 3.2.1.0
Redhat4 products
- libvncserver< 0:0.9.9-14.el7_8.1 | < 0:0.9.11-15.el8_2.1 | < 0:0.9.11-9.el8_1.3 | < 0:0.9.11-9.el8_0.3
- libvncserver-debuginfo< 0:0.9.9-14.el7_8.1 | < 0:0.9.11-15.el8_2.1 | < 0:0.9.11-9.el8_1.3 | < 0:0.9.11-9.el8_0.3
- libvncserver-debugsource< 0:0.9.11-15.el8_2.1 | < 0:0.9.11-9.el8_1.3 | < 0:0.9.11-9.el8_0.3
- libvncserver-devel< 0:0.9.9-14.el7_8.1 | < 0:0.9.11-15.el8_2.1 | < 0:0.9.11-9.el8_1.3
Suse4 products
- LibVNCServer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1< 0.9.10-4.19.1
- LibVNCServer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2< 0.9.10-4.19.1
- LibVNCServer&distro=SUSE Linux Enterprise Workstation Extension 15 SP1< 0.9.10-4.19.1
- LibVNCServer&distro=SUSE Linux Enterprise Workstation Extension 15 SP2< 0.9.10-4.19.1
Opensuse3 products
- leapEOL15.1 | 15.2
- LibVNCServer&distro=openSUSE Leap 15.1< 0.9.10-lp151.7.6.1
- LibVNCServer&distro=openSUSE Leap 15.2< 0.9.10-lp152.9.4.1
Ubuntu3 products
- libvncserver< 0.9.10+dfsg-3ubuntu0.16.04.4 | < 0.9.11+dfsg-1ubuntu1.2 | < 0.9.12+dfsg-9ubuntu0.1
- veyonAll versions (No fix recorded)
- x11vncAll versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.10 | 20.04
Debian1 product
- libvncserver< 0.9.12+dfsg-3
Fedoraproject1 product
- fedoraEOL31 | 32
Libvncserver_project1 product
- libvncserver< 0.9.12
9 vendors · 24 products
References
33 links- github.com/LibVNC/libvncserver/commit/aac95a9dcf4bbba87b76c72706c3221a842ca433X Refsource MISCPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/06/30/2X Refsource MISCMailing ListThird Party AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 33 references
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory