{"id":"CVE-2020-29260","aliases":["ALPINE-CVE-2020-29260","DEBIAN-CVE-2020-29260","DLA-3125-1","EUVD-2020-21635","GHSA-mgvc-cjfr-fjf4","MGASA-2022-0363","OESA-2022-2090","SUSE-SU-2022:3540-1","SUSE-SU-2022:3990-1","SUSE-SU-2022:4330-1","UBUNTU-CVE-2020-29260","USN-8463-1","openSUSE-SU-2024:12313-1"],"status":"published","title":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01131,"percentile":0.66646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-09-02T22:14:35Z","modified":"2026-11-03T06:32:25Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libvncserver","fixed_in":["0.9.13-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libvncserver","fixed_in":["0.9.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvncserver","fixed_in":["0.9.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvncserver","fixed_in":["0.9.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libvncserver","fixed_in":["0.9.13-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"italc","fixed_in":["3.0.3-6.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libvncserver","fixed_in":["0.9.13-3.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"LibVNCServer","fixed_in":["0.9.13-150400.3.3.1","0.9.10-150000.4.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"LibVNCServer","fixed_in":["0.9.13-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"LibVNCServer","fixed_in":["0.9.13-150400.3.3.1","0.9.10-150000.4.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"LibVNCServer","fixed_in":["0.9.10-150000.4.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"LibVNCServer","fixed_in":["0.9.10-150000.4.29.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"LibVNCServer","fixed_in":["0.9.10-150000.4.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"LibVNCServer","fixed_in":["0.9.9-17.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"LibVNCServer","fixed_in":["0.9.9-17.41.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"LibVNCServer","fixed_in":["0.9.9-17.41.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libvncserver","fixed_in":["0.9.13+dfsg-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1.3+deb10u5"}]}],"versions":["0.9.11+dfsg-1.3","0.9.11+dfsg-1.3+deb10u1","0.9.11+dfsg-1.3+deb10u2","0.9.11+dfsg-1.3+deb10u3","0.9.11+dfsg-1.3+deb10u4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-6.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-3.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.4.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.4.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.4.29.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.4.29.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-150000.4.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.41.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.9-6.4","1.3.9-6.4ubuntu1","1.3.9-6.5+deb8u1build0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2","0.9.10+dfsg-3ubuntu0.16.04.3","0.9.10+dfsg-3ubuntu0.16.04.4","0.9.10+dfsg-3ubuntu0.16.04.5","0.9.10+dfsg-3ubuntu0.16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.0.2+dfsg1-3","1:2.0.2+dfsg1-4","1:2.0.2+dfsg1-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.10-0ubuntu2","1.3.10-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-1.2build1","0.9.13-1.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1","0.9.11+dfsg-1ubuntu1.1","0.9.11+dfsg-1ubuntu1.2","0.9.11+dfsg-1ubuntu1.3","0.9.11+dfsg-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.0.3+dfsg1-1","1:3.0.3+dfsg1-2","1:3.0.3+dfsg1-2build1","1:3.0.3+dfsg1-2ubuntu1","1:3.0.3+dfsg1-3","1:3.0.3+dfsg1-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.10-0ubuntu3","1.3.10-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-2","0.9.13-2build1","0.9.13-3","0.9.13-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.11+dfsg-1.3","0.9.12+dfsg-3ubuntu3","0.9.12+dfsg-6","0.9.12+dfsg-7","0.9.12+dfsg-8","0.9.12+dfsg-9","0.9.12+dfsg-9ubuntu0.1","0.9.12+dfsg-9ubuntu0.2","0.9.12+dfsg-9ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.10-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.4+repack1-2","4.2.5+repack1-1","4.3.1+repack1-1","4.3.1+repack1-2","4.3.1+repack1-2build1","4.3.1+repack1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-6","0.9.16-3","0.9.16-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13+dfsg-3ubuntu0.1"}]}],"versions":["0.9.13+dfsg-3","0.9.13+dfsg-3build1","0.9.13+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.10-3","1:1.3.10-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.3+repack1-1build1","4.5.3+repack1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.16-7","0.9.16-7build1","0.9.16-8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.10-7","1:1.3.10-7build1","1:1.3.10-7build2","1:1.3.10-8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.5+repack1-1build2","4.7.5+repack1-1ubuntu1","4.7.5+repack1-1ubuntu3","4.7.5+repack1-1ubuntu4","4.7.5+repack1-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.16-9","0.9.16-9ubuntu1","0.9.16-10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.10-9","1:1.3.10-10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.5+repack1-1ubuntu6","4.7.5+repack1-1ubuntu7","4.9.7+repack1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.16-10","0.9.17-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.10-10build1","1:1.3.10-11"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.7+repack1-1build1","4.9.7+repack1-1.1","4.9.7+repack1-1.1build1","4.9.7+repack1-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.17-2","0.9.17-3","0.9.17-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tightvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.10-10","1:1.3.10-10build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.7+repack1-1","4.9.7+repack1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.17-1","0.9.17-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13+dfsg-3ubuntu0.1"}]}],"versions":["0.9.13+dfsg-3","0.9.13+dfsg-3build1","0.9.13+dfsg-3build2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.14+dfsg-1ubuntu0.1"}]}],"versions":["0.9.14+dfsg-1","0.9.14+dfsg-1build1","0.9.14+dfsg-1build2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15+dfsg-1ubuntu0.1"}]}],"versions":["0.9.14+dfsg-1build2","0.9.15+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15+dfsg-3ubuntu0.1"}]}],"versions":["0.9.15+dfsg-1","0.9.15+dfsg-2","0.9.15+dfsg-3"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libvncserver_project","product":"libvncserver"}],"references":[{"url":"https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29260","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mgvc-cjfr-fjf4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-29260","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-29260","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30917","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3125","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2090","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203106","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29260","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223990-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224330-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1170916","tags":["report"]},{"url":"https://bugzilla.suse.com/1204127","tags":["report"]},{"url":"https://bugzilla.suse.com/1204129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-29260","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29260","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8463-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44988","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T22:14:35Z","modified":"2024-08-04T16:48:01.6Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-21635","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T22:14:35Z","modified":"2024-08-04T16:48:01Z","updated_at":"2026-11-03T03:07:07.919663Z"}],"ghsa":[{"id":"GHSA-mgvc-cjfr-fjf4","title":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-03T00:00:15Z","modified":"2023-01-29T05:05:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:45:44.97547Z"}],"nvd":[{"id":"CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T23:15:08.227Z","modified":"2026-06-17T03:11:10.533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:47.286386Z"}],"osv":[{"id":"ALPINE-CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T23:15:08.227Z","modified":"2026-11-03T06:32:25.582798385Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T23:15:08.227Z","modified":"2026-10-20T13:59:35.760747112Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T23:15:08.227Z","modified":"2026-10-26T12:02:43.264340122Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"OESA-2022-2090","title":"libvncserver security update","description":"libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to \u0026quot;export\u0026quot; a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself.\r\n\r\nSecurity Fix(es):\r\n\r\nlibvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().(CVE-2020-29260)","status":"published","published":"2022-11-11T11:05:24Z","modified":"2026-08-18T01:16:56.216559447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().","status":"published","published":"2022-09-02T23:15:00Z","modified":"2026-10-17T12:56:54.96339798Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-3125-1","title":"libvncserver - security update","status":"published","published":"2022-09-30T00:00:00Z","modified":"2026-03-09T01:23:30.014514Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0363","title":"Updated libvncserver packages fix security vulnerability","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the\nfunction rfbClientCleanup(). (CVE-2020-29260)\n","status":"published","published":"2022-10-08T20:22:22Z","modified":"2026-04-16T04:44:19.683703071Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12313-1","title":"LibVNCServer-devel-0.9.13-4.1 on GA media","description":"These are all security issues fixed in the LibVNCServer-devel-0.9.13-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:26.347191Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3540-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).\n","status":"published","published":"2022-10-06T09:56:44Z","modified":"2026-02-04T02:23:18.625617Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3990-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).\n","status":"published","published":"2022-11-15T12:08:37Z","modified":"2026-02-04T02:44:00.486084Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4330-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).\n","status":"published","published":"2022-12-06T12:34:17Z","modified":"2025-05-02T04:30:47.445373Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-8463-1","title":"libvncserver vulnerabilities","description":"It was discovered that LibVNCServer had a memory leak in the client cleanup\nfunction. An attacker could possibly use this issue to cause LibVNCServer\nto consume memory, leading to a denial of service. This issue only affected\nUbuntu 22.04 LTS. (CVE-2020-29260)\n\nIt was discovered that LibVNCServer did not properly validate bounds when\nhandling UltraZip encoding subrectangles. A remote attacker could possibly\nuse this issue to obtain sensitive information or cause a denial of\nservice. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 25.04. (CVE-2026-32853)\n\nIt was discovered that LibVNCServer did not properly validate return values\nin the HTTP proxy handlers. A remote attacker could possibly use this issue\nto cause LibVNCServer to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04.\n(CVE-2026-32854)\n\nIt was discovered that LibVNCServer did not properly handle Tight encoding\ngradient filter rectangles. A remote attacker could use this issue to cause\nLibVNCServer to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-44988)","status":"published","published":"2026-06-23T14:46:54Z","modified":"2026-06-23T22:14:21.491003071Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}