CVE-2018-7225: canonical ubuntu_linux Integer Overflow or Wraparound
Vulnerability summary
CVE-2018-7225 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 6.11% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 19-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.11%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.11% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6
- enterprise_linux_server_eus7.5 | 7.6
- enterprise_linux_server_tus7.6
Debian4 products
- libvncserver< 0.9.11+dfsg-1.1 | < 0.9.9+dfsg2-6.1+deb8u3 | < 0.9.11+dfsg-1+deb9u1 | < 0.9.9+dfsg-1+deb7u3
- tightvnc< 1:1.3.9-9.1
- vino< 3.22.0-6
- debian_linuxEOL7.0 | 8.0 | 9.0
Ubuntu4 products
- italc< 1:2.0.2+dfsg1-4ubuntu0.1 | < 1:3.0.3+dfsg1-3ubuntu0.1
- libvncserver< 0.9.9+dfsg-1ubuntu1.3 | < 0.9.10+dfsg-3ubuntu0.16.04.2
- tightvnc< 1.3.9-6.5+deb8u1build0.14.04.1~esm1 | All versions (No fix recorded)
- vino< 3.8.1-0ubuntu9.3 | < 3.22.0-3ubuntu1.1 | < 3.22.0-5ubuntu2.1
Suse3 products
- LibVNCServer&distro=SUSE Linux Enterprise Server 11 SP4< 0.9.1-160.3.1
- LibVNCServer&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 0.9.1-160.3.1
- LibVNCServer&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 0.9.1-160.3.1
Mageia2 products
- libvncserver< 0.9.10-1.3.mga5
- libvncserver< 0.9.11-1.1.mga6
Alpine1 product
- libvncserver< 0.9.11-r2 | < 0.9.11-r1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10
Libvncserver_project1 product
- libvncserver≤ 0.9.11
8 vendors · 25 products
References
33 links
- lists.debian.org/debian-lts-announce/2018/03/msg00035.htmlMailing ListX Refsource MLISTThird Party Advisory
- www.openwall.com/lists/oss-security/2018/02/18/1X Refsource MISCExploitMailing ListThird Party AdvisoryREPORT
- access.redhat.com/errata/RHSA-2018:1055Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
