A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3125 advisory.

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

  - libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().
    (CVE-2020-29260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2020:14549-1 advisory.

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1811 advisory.

  - An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size. (CVE-2020-14405)

  - An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized     memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function. (CVE-2018-21247)

  - libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
    (CVE-2019-20839)

  - An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference. (CVE-2020-14397)

  - A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service. (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in ultra.c in LibVNCClient     in LibVNCServer before 0.9.11 allows remote servers to     cause a denial of service (application crash) or     possibly execute arbitrary code via a crafted     FramebufferUpdate message with the Ultra type tile,     such that the LZO payload decompressed length exceeds     what is specified by the tile     dimensions.(CVE-2016-9942)

  - It was discovered that websockets.c in LibVNCServer     prior to 0.9.12 did not properly decode certain     WebSocket frames. A malicious attacker could exploit     this by sending specially crafted WebSocket frames to a     server, causing a heap-based buffer     overflow.(CVE-2017-18922)

  - LibVNC commit before     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a     memory leak (CWE-655) in VNC server code, which allow     an attacker to read stack memory and can be abused for     information disclosure. Combined with another     vulnerability, it can be used to leak stack memory and     bypass ASLR. This attack appear to be exploitable via     network connectivity. These vulnerabilities have been     fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.(CVE-2019-1568     1)

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A divide by zero issue was found to occur in     libvncserver-0.9.12. A malicious client could use this     flaw to send a specially crafted message that, when     processed by the VNC server, would lead to a floating     point exception, resulting in a denial of     service.(CVE-2020-25708)

  - An issue was discovered in LibVNCServer before 0.9.13.
    libvncserver/ws_decode.c can lead to a crash because of     unaligned accesses in     hybiReadAndDecode.(CVE-2019-20840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c has a divide by zero which could result in DoS

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibVNCServer fixes the following issues :

  - CVE-2020-25708 [bsc#1178682], libvncserver/rfbserver.c     has a divide by zero which could result in DoS

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4636-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue has been found in libvncserver, an API to write one's own VNC server. Due to some missing checks, a divide by zero could happen, which could result in a denial of service.

For Debian 9 stretch, this problem has been fixed in version 0.9.11+dfsg-1.3~deb9u6.

We recommend that you upgrade your libvncserver packages.

For the detailed security status of libvncserver please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libvncserver

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184742	Rocky Linux 8 : libvncserver (RLSA-2021:1811)	Nessus	Rocky Linux Local Security Checks	high
165593	Debian DLA-3125-1 : libvncserver - LTS security update	Nessus	Debian Local Security Checks	high
160737	NewStart CGSL MAIN 6.02 : libvncserver Multiple Vulnerabilities (NS-SA-2022-0048)	Nessus	NewStart CGSL Local Security Checks	high
157648	AlmaLinux 8 : libvncserver (ALSA-2021:1811)	Nessus	Alma Linux Local Security Checks	high
150527	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2020:14549-1)	Nessus	SuSE Local Security Checks	high
149968	Oracle Linux 8 : libvncserver (ELSA-2021-1811)	Nessus	Oracle Linux Local Security Checks	high
149728	CentOS 8 : libvncserver (CESA-2021:1811)	Nessus	CentOS Local Security Checks	high
149663	RHEL 8 : libvncserver (RHSA-2021:1811)	Nessus	Red Hat Local Security Checks	high
148083	EulerOS 2.0 SP5 : libvncserver (EulerOS-SA-2021-1688)	Nessus	Huawei Local Security Checks	high
146731	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2021-1321)	Nessus	Huawei Local Security Checks	critical
145732	EulerOS 2.0 SP8 : libvncserver (EulerOS-SA-2021-1153)	Nessus	Huawei Local Security Checks	high
145206	EulerOS 2.0 SP3 : libvncserver (EulerOS-SA-2021-1091)	Nessus	Huawei Local Security Checks	critical
143764	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:3550-1)	Nessus	SuSE Local Security Checks	high
143668	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:3515-1)	Nessus	SuSE Local Security Checks	high
143345	openSUSE Security Update : LibVNCServer (openSUSE-2020-2025)	Nessus	SuSE Local Security Checks	high
143328	openSUSE Security Update : LibVNCServer (openSUSE-2020-2097)	Nessus	SuSE Local Security Checks	high
142998	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer, Vino vulnerability (USN-4636-1)	Nessus	Ubuntu Local Security Checks	high
142924	Debian DLA-2451-1 : libvncserver security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-25708

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high