7.5

CVE-2020-25708: debian debian_linux Divide By Zero

CVSS: 7.5v3.1HighModified
AliasesMGASA-2020-0439SUSE-SU-2020:14549-1SUSE-SU-2020:3515-1
Published 27-11-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-25708 is a high (CVSS 7.5) Divide By Zero vulnerability in debian debian_linux. EPSS estimates a 1.63% chance of exploitation in the next 30 days, higher than 75.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
1.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2
DLA-3125-1RHSA-2021:1811

Timeline

  1. 27-11-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.63%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

0.00 pp

From 1.63% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse24 products
  • LibVNCServer&distro=HPE Helion OpenStack 8< 0.9.9-17.34.1
  • LibVNCServer&distro=SUSE Enterprise Storage 5< 0.9.9-17.34.1
  • LibVNCServer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1< 0.9.10-4.25.1
  • LibVNCServer&distro=SUSE Linux Enterprise Module for Package Hub 15 SP2< 0.9.10-4.25.1
  • LibVNCServer&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 0.9.1-160.22.1
Ubuntu6 products
  • italcAll versions (No fix recorded)
  • libvncserver< 0.9.10+dfsg-3ubuntu0.16.04.6 | < 0.9.11+dfsg-1ubuntu1.4 | < 0.9.12+dfsg-9ubuntu0.3
  • tightvncAll versions (No fix recorded)
  • veyonAll versions (No fix recorded)
  • vino< 3.8.1-0ubuntu9.4 | < 3.22.0-3ubuntu1.2 | < 3.22.0-5ubuntu2.2 | < 3.22.0-6ubuntu3
Debian2 products
  • libvncserver< 0.9.13+dfsg-1 | < 0.9.11+dfsg-1.3~deb9u6
  • debian_linuxEOL10.0
Opensuse2 products
  • LibVNCServer&distro=openSUSE Leap 15.1< 0.9.10-lp151.7.12.1
  • LibVNCServer&distro=openSUSE Leap 15.2< 0.9.10-lp152.9.8.1
Libvncserver_project1 product
Mageia1 product
  • vino< 3.22.0-3.3.mga7
Redhat1 product

7 vendors · 37 products

References

16 links
Show all 16 references