CVE-2018-20023 is an Improper Initialization vulnerability (CWE-665) in LibVNC before version 8b06f835e259652b0ff026898014fc7297ade858, affecting various Canonical and Debian Linux distributions and their LibVNCServer packages. This vulnerability allows an unauthenticated attacker to read stack memory, potentially leading to information disclosure and, when combined with other vulnerabilities, could bypass ASLR. It carries a CVSSv3 score of 7.5 (High), indicating a network-exploitable vulnerability with low attack complexity and high confidentiality impact. While there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable, and community discussion is limited, though it has received some media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.9.12CPE matchmatch criteria | cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.