CVE-2018-15126

Published: 19 December 2018

LibVNC before commit 73cb96fec028a576a5a24417b57723b55854ad7b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libvncserver
Launchpad, Ubuntu, Debian
Upstream
Released (0.9.11+dfsg-1.2)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (0.9.11+dfsg-1ubuntu1.1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.9.10+dfsg-3ubuntu0.16.04.3)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [0.9.9+dfsg-1ubuntu1.4])
Patches:
Upstream: https://github.com/LibVNC/libvncserver/commit/162d716b4c095a87aab2261857d583d68e3b3ea6
x11vnc
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(uses shared libvnc)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(uses shared libvnc)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(uses shared libvnc)