CVE-2018-20023: High severity Libvnc Project Libvncserver vulnerability
Last updated 25 August 2025
Other sources
LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
debian/veyonto a version that resolves this vulnerability.Fixed in 4.5.3+repack1-1Fixed in 4.7.5+repack1-1Fixed in 4.9.5+repack1-2Fixed in 4.9.7+repack1-1.1 - Upgrade
Upgrade
LibVNCto a version that resolves this vulnerability.Fixed in 8b06f835e259652b0ff026898014fc7297ade858Patch 8b06f835e259652b0ff026898014fc7297ade858
Event History
Frequently Asked Questions
What is CVE-2018-20023?
CVE-2018-20023 is a vulnerability in LibVNC that allows attackers to read stack memory and potentially leak sensitive information.
How severe is CVE-2018-20023?
CVE-2018-20023 has a severity score of 7.5, which is considered high.
What is CWE-665?
CWE-665 is the Common Weakness Enumeration category for the vulnerability in LibVNC that allows improper initialization and can lead to information disclosure.
Which software versions are affected by CVE-2018-20023?
CVE-2018-20023 affects LibVNC versions 0.9.9 up to 0.9.12.
How can I fix CVE-2018-20023?
To fix CVE-2018-20023, you should update to the latest version of LibVNC that includes the patch for this vulnerability.