{"id":"CVE-2024-42458","aliases":["ALPINE-CVE-2024-42458","DEBIAN-CVE-2024-42458","EUVD-2024-39628","GHSA-jxwh-98r5-mx84","UBUNTU-CVE-2024-42458","openSUSE-SU-2024:14238-1"],"status":"published","title":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type.","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0083,"percentile":0.57809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-08-02T00:00:00Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"neatvnc","fixed_in":["0.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"neatvnc","fixed_in":["0.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"neatvnc","fixed_in":["0.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"neatvnc","fixed_in":["0.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"neatvnc","fixed_in":["0.8.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"neatvnc","fixed_in":["0.8.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neatvnc","fixed_in":["0.8.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"neatvnc","fixed_in":["0.8.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4+dfsg-1","0.5.4+dfsg-2~exp1","0.6.0+dfsg-1","0.6.0+dfsg-2","0.6.0+dfsg-3","0.6.0+dfsg-4","0.7.0+dfsg-1","0.7.0+dfsg-1~exp1","0.7.1+dfsg-1","0.7.1+dfsg-2","0.8.0+dfsg-1","0.8.0+dfsg-2","0.8.0+dfsg-3","0.9.1+dfsg-1","0.9.1+dfsg-1.1","1.0.0+dfsg-1~exp1","1.0.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.0+dfsg-4build1","0.7.0+dfsg-1","0.7.1+dfsg-1","0.7.1+dfsg-2","0.7.1+dfsg-2build2","0.7.1+dfsg-2build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"neatvnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-1.1"}]}]}],"products":[{"vendor":"any1","product":"neatvnc"}],"references":[{"url":"https://github.com/any1/neatvnc/commit/cc71650a69abc2573a0d96d082409d2468802d47","tags":["Patch","fix"]},{"url":"https://github.com/any1/neatvnc/compare/v0.8.0...v0.8.1","tags":["Patch","web","report"]},{"url":"https://github.com/any1/neatvnc/releases/tag/v0.8.1","tags":["Patch","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/08/02/1","tags":["Mailing List","Patch","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/08/02/7","tags":["Mailing List","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/08/02/10","tags":["Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42458","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jxwh-98r5-mx84"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-42458","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42458.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42458","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-42458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42458","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42458","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2024-08-07T15:20:47.299Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-39628","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2024-08-07T15:20:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T01:16:18.681639Z"}],"ghsa":[{"id":"GHSA-jxwh-98r5-mx84","title":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type.","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type.","status":"published","published":"2024-08-02T06:30:56Z","modified":"2024-08-07T18:31:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:57:53.484343Z"}],"nvd":[{"id":"CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T04:17:30.593Z","modified":"2026-06-17T07:49:29.157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:15.933769Z"}],"osv":[{"id":"ALPINE-CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T04:17:30.593Z","modified":"2026-11-03T06:32:59.909785478Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2026-10-28T10:58:07.288410023Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T04:17:30.593Z","modified":"2026-11-02T12:02:47.702778157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"UBUNTU-CVE-2024-42458","description":"server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.","status":"published","published":"2024-08-02T04:17:00Z","modified":"2026-04-22T15:04:51.571221Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"openSUSE-SU-2024:14238-1","title":"libneatvnc0-0.8.1-1.1 on GA media","description":"These are all security issues fixed in the libneatvnc0-0.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-02T00:00:00Z","modified":"2026-02-04T03:29:44.644683Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}