CVE-2018-6307

Published: 19 December 2018

LibVNC before commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap use-after-free vulnerability in server code of file transfer extension that can result remote code execution.

Priority

Medium

CVSS 3 base score: 8.1

Status

Package Release Status
libvncserver
Launchpad, Ubuntu, Debian
Upstream
Released (0.9.11+dfsg-1.2)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (0.9.11+dfsg-1ubuntu1.1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (0.9.10+dfsg-3ubuntu0.16.04.3)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [0.9.9+dfsg-1ubuntu1.4])
Patches:
Upstream: https://github.com/LibVNC/libvncserver/commit/ca2a5ac02fbbadd0a21fabba779c1ea69173d10b
x11vnc
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(uses shared libvnc)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(uses shared libvnc)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(uses shared libvnc)