Every CVE Search/ Get API key

CVE-2018-6307

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free...

8.1 HighFix available

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

26.5%Up 23.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
CVE-2018-6307
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
CVE-2018-6307
Updated
2026-11-02
EUVDEUVD-2018-18068 No score

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
EUVD-2018-18068
Updated
2026-11-03
GitHub AdvisoriesGHSA-862p-2jpg-8gg4 8.1

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free...

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
GHSA-862p-2jpg-8gg4
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 8.1

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
CVE-2018-6307
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-6307 8.1

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
DEBIAN-CVE-2018-6307
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2018-6307 8.1

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Record
UBUNTU-CVE-2018-6307
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0037 No score

Updated libvncserver & x11vnc packages fix security vulnerabilities

A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-6307).

A heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-15126).

A heap out-of-bound write vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be exploitable via network connectivity (CVE-2018-15127).

Multiple heap out-of-bound write vulnerabilities in VNC client code, which can result in remote code execution (CVE-2018-20019).

Heap out-of-bound write vulnerability in a structure in VNC client code, which can result in remote code execution (CVE-2018-20020).

Infinite Loop vulnerability in VNC client code. The vulnerability could allow an attacker to consume an excessive amount of resources, such as CPU and RAM (CVE-2018-20021).

Improper Initialization weaknesses in VNC client code, which could allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR (CVE-2018-20022).

Improper Initialization vulnerability in VNC Repeater client code, which could allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and bypass ASLR (CVE-2018-20023).

A null pointer dereference in VNC client code, which can result in DoS (CVE-2018-20024).

Record
MGASA-2019-0037
Updated
2026-11-02
OSVopenSUSE-SU-2019:0053-1 No score

Security update for LibVNCServer

This update for LibVNCServer fixes the following issues:

Security issues fixed:

  • CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)
  • CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)
  • CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)
  • CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)
  • CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)
  • CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)
  • CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)
  • CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)
  • CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0053-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10598-1 No score

LibVNCServer-devel-0.9.13-3.1 on GA media

These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10598-1
Updated
2026-11-02
OSVSUSE-SU-2019:0060-1 No score

Security update for LibVNCServer

This update for LibVNCServer fixes the following issues:

Security issues fixed:

  • CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)
  • CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)
  • CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)
  • CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)
  • CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)
  • CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)
  • CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)
  • CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)
  • CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)
Record
SUSE-SU-2019:0060-1
Updated
2026-11-02
OSVSUSE-SU-2019:0060-2 No score

Security update for LibVNCServer

This update for LibVNCServer fixes the following issues:

Security issues fixed:

  • CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)
  • CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)
  • CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)
  • CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)
  • CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)
  • CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)
  • CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)
  • CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)
  • CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)
Record
SUSE-SU-2019:0060-2
Updated
2026-11-02
OSVSUSE-SU-2019:0080-1 No score

Security update for LibVNCServer

This update for LibVNCServer fixes the following issues:

Security issues fixed:

  • CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)
  • CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)
  • CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)
  • CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)
  • CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)
  • CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)
  • CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)
  • CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)
  • CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)
Record
SUSE-SU-2019:0080-1
Updated
2026-11-02
OSVSUSE-SU-2019:13927-1 No score

Security update for LibVNCServer

This update for LibVNCServer fixes the following issues:

Security issues fixed:

  • CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)
  • CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)
  • CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)
  • CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)
  • CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)
  • CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)
  • CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)
  • CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)
Record
SUSE-SU-2019:13927-1
Updated
2026-11-02
OSVUSN-3877-1 No score

libvncserver vulnerabilities

It was discovered that LibVNCServer incorrectly handled certain operations. A remote attacker able to connect to applications using LibVNCServer could possibly use this issue to obtain sensitive information, cause a denial of service, or execute arbitrary code.

Record
USN-3877-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libvncserver
Debian:12
 before 0.9.11+dfsg-1.2
0.9.11+dfsg-1.2
libvncserver
Debian:13
 before 0.9.11+dfsg-1.2
0.9.11+dfsg-1.2
libvncserver
Debian:14
 before 0.9.11+dfsg-1.2
0.9.11+dfsg-1.2
libvncserver
Debian:8
From an advisory covering 9 CVEs
 before 0.9.9+dfsg2-6.1+deb8u4, plus listed versions
0.9.9+dfsg-6.10.9.9+dfsg2-6.1+deb8u10.9.9+dfsg2-6.1+deb8u20.9.9+dfsg2-6.1+deb8u3
0.9.9+dfsg2-6.1+deb8u4
italc
Debian:8
From an advisory covering 21 CVEs
 before 1:2.0.2+dfsg1-2+deb8u1, plus listed versions
1:2.0.2+dfsg1-2
1:2.0.2+dfsg1-2+deb8u1
libvncserver
Debian:9
From an advisory covering 10 CVEs
 before 0.9.11+dfsg-1.3~deb9u1, plus listed versions
0.9.11+dfsg-10.9.11+dfsg-1+deb9u10.9.11+dfsg-1.10.9.11+dfsg-1.2
0.9.11+dfsg-1.3~deb9u1
libvncserver
Mageia:6
From an advisory covering 9 CVEs
 before 0.9.12-1.mga6
0.9.12-1.mga6
x11vnc
Mageia:6
From an advisory covering 9 CVEs
 before 0.9.16-1.mga6
0.9.16-1.mga6
LibVNCServer
SUSE:OpenStack Cloud 7
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
LibVNCServer
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Enterprise Storage 4
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 9 CVEs
 before 0.9.9-17.8.1
0.9.9-17.8.1
LibVNCServer
SUSE:Linux Enterprise Module for Package Hub 15
From an advisory covering 9 CVEs
 before 0.9.10-4.3.1
0.9.10-4.3.1
LibVNCServer
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 9 CVEs
 before 0.9.10-4.3.1
0.9.10-4.3.1
LibVNCServer
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
LibVNCServer
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
LibVNCServer
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
LibVNCServer
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
LibVNCServer
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
LibVNCServer
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 8 CVEs
 before 0.9.1-160.6.1
0.9.1-160.6.1
libvncserver
Ubuntu:14.04:LTS
 before 0.9.9+dfsg-1ubuntu1.4, plus listed versions
0.9.9+dfsg-10.9.9+dfsg-1ubuntu10.9.9+dfsg-1ubuntu1.10.9.9+dfsg-1ubuntu1.20.9.9+dfsg-1ubuntu1.3
0.9.9+dfsg-1ubuntu1.4
libvncserver
Ubuntu:16.04:LTS
 before 0.9.10+dfsg-3ubuntu0.16.04.3, plus listed versions
0.9.10+dfsg-30.9.10+dfsg-3build10.9.10+dfsg-3ubuntu0.16.04.10.9.10+dfsg-3ubuntu0.16.04.2
0.9.10+dfsg-3ubuntu0.16.04.3
libvncserver
Ubuntu:18.04:LTS
 before 0.9.11+dfsg-1ubuntu1.1, plus listed versions
0.9.11+dfsg-10.9.11+dfsg-1ubuntu1
0.9.11+dfsg-1ubuntu1.1
libvncserver
Ubuntu:14.04:LTS
From an advisory covering 12 CVEs
 before 0.9.9+dfsg-1ubuntu1.4, plus listed versions
0.9.9+dfsg-10.9.9+dfsg-1ubuntu10.9.9+dfsg-1ubuntu1.10.9.9+dfsg-1ubuntu1.20.9.9+dfsg-1ubuntu1.3
0.9.9+dfsg-1ubuntu1.4
libvncserver
Ubuntu:16.04:LTS
From an advisory covering 12 CVEs
 before 0.9.10+dfsg-3ubuntu0.16.04.3, plus listed versions
0.9.10+dfsg-30.9.10+dfsg-3build10.9.10+dfsg-3ubuntu0.16.04.10.9.10+dfsg-3ubuntu0.16.04.2
0.9.10+dfsg-3ubuntu0.16.04.3
libvncserver
Ubuntu:18.04:LTS
From an advisory covering 12 CVEs
 before 0.9.11+dfsg-1ubuntu1.1, plus listed versions
0.9.11+dfsg-10.9.11+dfsg-1ubuntu1
0.9.11+dfsg-1ubuntu1.1
LibVNCServer
openSUSE:Leap 15.0
From an advisory covering 9 CVEs
 before 0.9.10-lp150.3.3.1
0.9.10-lp150.3.3.1

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6307 is a high vulnerability (CVSS 8.1) in Kaspersky Libvnc, published December 19, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.5%, the 98th percentile. Fixed in libvncserver 0.9.11+dfsg-1.2.

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open