{"id":"CVE-2018-6307","aliases":["DEBIAN-CVE-2018-6307","DLA-1617-1","DLA-1979-1","DSA-4383-1","EUVD-2018-18068","GHSA-862p-2jpg-8gg4","MGASA-2019-0037","SUSE-SU-2019:0060-1","SUSE-SU-2019:0060-2","SUSE-SU-2019:0080-1","SUSE-SU-2019:13927-1","UBUNTU-CVE-2018-6307","USN-3877-1","openSUSE-SU-2019:0053-1","openSUSE-SU-2024:10598-1"],"status":"published","title":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free...","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.26543,"percentile":0.98026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-12-19T00:00:00Z","modified":"2026-10-23T18:03:07Z","fixes":[{"ecosystem":"Debian:12","package":"libvncserver","fixed_in":["0.9.11+dfsg-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvncserver","fixed_in":["0.9.11+dfsg-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvncserver","fixed_in":["0.9.11+dfsg-1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","fixed_in":["0.9.9+dfsg-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","fixed_in":["0.9.10+dfsg-3ubuntu0.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","fixed_in":["0.9.11+dfsg-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg2-6.1+deb8u4"}]}],"versions":["0.9.9+dfsg-6.1","0.9.9+dfsg2-6.1+deb8u1","0.9.9+dfsg2-6.1+deb8u2","0.9.9+dfsg2-6.1+deb8u3"],"bundled":9},{"source":"osv","ecosystem":"Debian:8","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2+dfsg1-2+deb8u1"}]}],"versions":["1:2.0.2+dfsg1-2"],"bundled":21},{"source":"osv","ecosystem":"Debian:9","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.3~deb9u1"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1+deb9u1","0.9.11+dfsg-1.1","0.9.11+dfsg-1.2"],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1.mga6"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:6","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.16-1.mga6"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-1ubuntu1.4"}]}],"versions":["0.9.9+dfsg-1","0.9.9+dfsg-1ubuntu1","0.9.9+dfsg-1ubuntu1.1","0.9.9+dfsg-1ubuntu1.2","0.9.9+dfsg-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.3"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.1"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-1ubuntu1.4"}]}],"versions":["0.9.9+dfsg-1","0.9.9+dfsg-1ubuntu1","0.9.9+dfsg-1ubuntu1.1","0.9.9+dfsg-1ubuntu1.2","0.9.9+dfsg-1ubuntu1.3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.3"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.1"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-lp150.3.3.1"}]}],"bundled":9}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"kaspersky","product":"libvnc"},{"vendor":"libvnc_project","product":"libvncserver"}],"references":[{"url":"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-026-libvnc-heap-use-after-free/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2019/dsa-4383","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3877-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6307"},{"url":"https://github.com/LibVNC/libvncserver/issues/241","tags":["Third Party Advisory","advisory"]},{"url":"https://github.com/advisories/GHSA-862p-2jpg-8gg4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6307","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0037.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24177","tags":["report"]},{"url":"https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.12","tags":["web"]},{"url":"https://github.com/LibVNC/x11vnc/releases/tag/0.9.15","tags":["web"]},{"url":"https://github.com/LibVNC/x11vnc/releases/tag/0.9.16","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-01/msg00027.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190060-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120114","tags":["report"]},{"url":"https://bugzilla.suse.com/1120115","tags":["report"]},{"url":"https://bugzilla.suse.com/1120116","tags":["report"]},{"url":"https://bugzilla.suse.com/1120117","tags":["report"]},{"url":"https://bugzilla.suse.com/1120118","tags":["report"]},{"url":"https://bugzilla.suse.com/1120119","tags":["report"]},{"url":"https://bugzilla.suse.com/1120120","tags":["report"]},{"url":"https://bugzilla.suse.com/1120121","tags":["report"]},{"url":"https://bugzilla.suse.com/1120122","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6307","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190060-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190080-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913927-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-6307","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3877-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20750","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JTHKEDNEFXZVR4ENXDXILQ6VQAFX3VBZ/#JTHKEDNEFXZVR4ENXDXILQ6VQAFX3VBZ","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25708","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-6307","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T16:00:00Z","modified":"2024-08-05T06:01:48.679Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18068","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T16:00:00Z","modified":"2024-08-05T06:01:48Z","updated_at":"2026-11-03T02:40:08.595407Z"}],"ghsa":[{"id":"GHSA-862p-2jpg-8gg4","title":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free...","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2022-05-13T01:30:45Z","modified":"2023-02-01T05:08:16Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:50:43.431885Z"}],"nvd":[{"id":"CVE-2018-6307","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T16:29:00.593Z","modified":"2026-06-17T02:01:38.42Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-6307","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T16:29:00.593Z","modified":"2026-10-20T10:49:55.359761642Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6307","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T16:29:00.593Z","modified":"2026-10-23T18:03:07.531092854Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-6307","description":"LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.","status":"published","published":"2018-12-19T00:00:00Z","modified":"2026-04-22T12:01:24.765105Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-1617-1","title":"libvncserver - security update","status":"published","published":"2018-12-25T00:00:00Z","modified":"2026-03-09T01:18:03.32383Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1979-1","title":"italc - security update","status":"published","published":"2019-10-30T00:00:00Z","modified":"2026-03-09T01:18:20.937176Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4383-1","title":"libvncserver - security update","status":"published","published":"2019-02-03T00:00:00Z","modified":"2026-03-09T02:09:27.290956Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0037","title":"Updated libvncserver \u0026 x11vnc packages fix security vulnerabilities","description":"A heap use-after-free vulnerability in the server code of the file\ntransfer extension, which can result in remote code execution. This\nattack appears to be exploitable via network connectivity\n(CVE-2018-6307).\n\nA heap use-after-free vulnerability in the server code of the file\ntransfer extension, which can result in remote code execution. This\nattack appears to be exploitable via network connectivity\n(CVE-2018-15126).\n\nA heap out-of-bound write vulnerability in the server code of the file\ntransfer extension, which can result in remote code execution. This\nattack appears to be exploitable via network connectivity\n(CVE-2018-15127).\n\nMultiple heap out-of-bound write vulnerabilities in VNC client code,\nwhich can result in remote code execution (CVE-2018-20019).\n\nHeap out-of-bound write vulnerability in a structure in VNC client code,\nwhich can result in remote code execution (CVE-2018-20020).\n\nInfinite Loop vulnerability in VNC client code. The vulnerability could\nallow an attacker to consume an excessive amount of resources, such as\nCPU and RAM (CVE-2018-20021).\n\nImproper Initialization weaknesses in VNC client code, which could allow\nan attacker to read stack memory and can be abused for information\ndisclosure. Combined with another vulnerability, it can be used to leak\nstack memory layout and bypass ASLR (CVE-2018-20022).\n\nImproper Initialization vulnerability in VNC Repeater client code, which\ncould allow an attacker to read stack memory and can be abused for\ninformation disclosure. Combined with another vulnerability, it can be\nused to leak stack memory layout and bypass ASLR (CVE-2018-20023).\n\nA null pointer dereference in VNC client code, which can result in DoS\n(CVE-2018-20024).\n","status":"published","published":"2019-01-15T22:15:34Z","modified":"2026-04-16T06:22:49.228332068Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0053-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)\n- CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)\n- CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)\n- CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)\n- CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)\n- CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)\n- CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)\n- CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)\n- CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:46:24Z","modified":"2026-02-04T04:28:21.332984Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10598-1","title":"LibVNCServer-devel-0.9.13-3.1 on GA media","description":"These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:49.041318Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0060-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)\n- CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)\n- CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)\n- CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)\n- CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)\n- CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)\n- CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)\n- CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)\n- CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)\n","status":"published","published":"2019-01-10T15:06:54Z","modified":"2026-02-04T02:35:32.532707Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0060-2","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)\n- CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)\n- CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)\n- CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)\n- CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)\n- CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)\n- CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)\n- CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)\n- CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)\n","status":"published","published":"2019-04-29T05:55:37Z","modified":"2026-02-04T03:54:31.076293Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0080-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)\n- CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)\n- CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)\n- CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)\n- CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)\n- CVE-2018-20023: Fixed information disclosure through improper initialization in VNC Repeater client code (bsc#1120119)\n- CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)\n- CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)\n- CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)\n","status":"published","published":"2019-01-11T16:05:57Z","modified":"2026-02-04T02:38:02.352956Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13927-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114)\n- CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115)\n- CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116)\n- CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117)\n- CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118)\n- CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120)\n- CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121)\n- CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122)\n","status":"published","published":"2019-01-11T08:42:54Z","modified":"2026-02-04T04:26:59.955142Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3877-1","title":"libvncserver vulnerabilities","description":"It was discovered that LibVNCServer incorrectly handled certain operations.\nA remote attacker able to connect to applications using LibVNCServer could\npossibly use this issue to obtain sensitive information, cause a denial of\nservice, or execute arbitrary code.\n","status":"published","published":"2019-01-31T19:09:23Z","modified":"2026-04-27T15:33:05.447679096Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}