{"id":"CVE-2019-20788","aliases":["DEBIAN-CVE-2019-20788","DLA-2146-1","EUVD-2019-11326","GHSA-7397-jpw5-q274","MGASA-2020-0207","RHSA-2020:0913","RHSA-2020:0920","RHSA-2020:0921","SUSE-SU-2020:1164-1","SUSE-SU-2020:1164-2","SUSE-SU-2020:1165-1","SUSE-SU-2020:14355-1","UBUNTU-CVE-2019-20788","USN-4407-1","openSUSE-SU-2020:0624-1","openSUSE-SU-2024:10598-1"],"status":"published","title":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and...","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02497,"percentile":0.84895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2020-03-18T00:00:00Z","modified":"2026-10-20T13:42:59Z","fixes":[{"ecosystem":"Debian:12","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libvncserver","fixed_in":["0.9.12-2.3.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","fixed_in":["0.9.10+dfsg-3ubuntu0.16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","fixed_in":["0.9.11+dfsg-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg2-6.1+deb8u7"}]}],"versions":["0.9.9+dfsg-6.1","0.9.9+dfsg2-6.1+deb8u1","0.9.9+dfsg2-6.1+deb8u2","0.9.9+dfsg2-6.1+deb8u3","0.9.9+dfsg2-6.1+deb8u4","0.9.9+dfsg2-6.1+deb8u5","0.9.9+dfsg2-6.1+deb8u6"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-2.3.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.4"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2","0.9.10+dfsg-3ubuntu0.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.2"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1","0.9.11+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.4"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2","0.9.10+dfsg-3ubuntu0.16.04.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.2"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1","0.9.11+dfsg-1ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9ubuntu0.1"}]}],"versions":["0.9.11+dfsg-1.3","0.9.12+dfsg-3ubuntu3","0.9.12+dfsg-6","0.9.12+dfsg-7","0.9.12+dfsg-8","0.9.12+dfsg-9"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-lp151.7.3.1"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"libvnc_project","product":"libvncserver"},{"vendor":"siemens","product":"simatic_itc1500_firmware"},{"vendor":"siemens","product":"simatic_itc1500_pro_firmware"},{"vendor":"siemens","product":"simatic_itc1900_firmware"},{"vendor":"siemens","product":"simatic_itc1900_pro_firmware"},{"vendor":"siemens","product":"simatic_itc2200_firmware"},{"vendor":"siemens","product":"simatic_itc2200_pro_firmware"}],"references":[{"url":"https://github.com/LibVNC/libvncserver/commit/54220248886b5001fbbb9fa73c4e1a2cb9413fed","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4407-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-064-libvnc-libvncclient","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20788","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7397-jpw5-q274"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20788","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0207.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26587","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0913","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811948","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0913.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20788","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0920","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0920.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0921","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0921.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201164-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1155419","tags":["report"]},{"url":"https://bugzilla.suse.com/1160471","tags":["report"]},{"url":"https://bugzilla.suse.com/1170441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20788","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201164-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201165-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014355-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20788","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4407-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15690","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/X6PQATT2HQIOVLXBCKXH2SSVO2ZT5TCP/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25708","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-20788","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T18:06:55Z","modified":"2024-08-05T02:53:09.241Z","updated_at":"2026-11-02T14:20:17.11067Z"}],"euvd":[{"id":"EUVD-2019-11326","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T18:06:55Z","modified":"2024-08-05T02:53:09Z","updated_at":"2026-11-03T02:40:20.727542Z"}],"ghsa":[{"id":"GHSA-7397-jpw5-q274","title":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and...","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2022-05-24T17:16:15Z","modified":"2023-01-29T05:02:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:45:08.540426Z"}],"nvd":[{"id":"CVE-2019-20788","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T19:15:12.763Z","modified":"2026-06-17T02:31:11.817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-20788","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T19:15:12.763Z","modified":"2026-10-20T13:42:59.839325709Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20788","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T19:15:12.763Z","modified":"2026-09-21T07:03:17.81642858Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:0913","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:21Z","modified":"2026-06-27T10:09:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0920","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:28Z","modified":"2026-06-27T10:09:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0921","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:36Z","modified":"2026-06-27T10:09:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-20788","description":"libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.","status":"published","published":"2020-04-23T19:15:00Z","modified":"2026-04-22T12:16:45.789148Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2146-1","title":"libvncserver - security update","status":"published","published":"2020-03-18T00:00:00Z","modified":"2026-03-09T01:21:18.946031Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0207","title":"Updated libvncserver packages fix security vulnerability","description":"Updated libvncserver packages fix security vulnerability:\n\nlibvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape\ninteger overflow and heap-based buffer overflow via a large height or width\nvalue (CVE-2019-20788).\n","status":"published","published":"2020-05-08T10:57:54Z","modified":"2026-04-16T04:44:18.96633316Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0624-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-05-08T10:22:03Z","modified":"2026-02-04T02:23:54.742498Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10598-1","title":"LibVNCServer-devel-0.9.13-3.1 on GA media","description":"These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:49.041318Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:1164-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:28:50Z","modified":"2026-02-04T02:23:09.069412Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1164-2","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-07-07T11:43:24Z","modified":"2026-02-04T02:20:31.416322Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1165-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:32:01Z","modified":"2026-02-04T03:38:27.196955Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14355-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:32:51Z","modified":"2026-02-04T04:29:34.925515Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4407-1","title":"libvncserver vulnerabilities","description":"It was discovered that LibVNCServer incorrectly handled decompressing data. An\nattacker could possibly use this issue to cause LibVNCServer to crash,\nresulting in a denial of service. (CVE-2019-15680)\n\nIt was discovered that an information disclosure vulnerability existed in\nLibVNCServer when sending a ServerCutText message. An attacker could possibly\nuse this issue to expose sensitive information. This issue only affected\nUbuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)\n\nIt was discovered that LibVNCServer incorrectly handled cursor shape updates.\nIf a user were tricked in to connecting to a malicious server, an attacker\ncould possibly use this issue to cause LibVNCServer to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.\n(CVE-2019-15690, CVE-2019-20788)\n\nIt was discovered that LibVNCServer incorrectly handled decoding WebSocket\nframes. An attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service, or possibly execute arbitrary code.\nThis issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.\n(CVE-2017-18922)\n","status":"published","published":"2020-07-01T23:44:41Z","modified":"2026-04-27T15:39:05.015501Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}