CVE-2020-14396: Null Pointer Dereference
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tlsopenssl.c has a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
LibVNCServerto a version that resolves this vulnerability.Fixed in 0.9.13
Event History
Frequently Asked Questions
What is CVE-2020-14396?
CVE-2020-14396 is a vulnerability in LibVNCServer that allows for a NULL pointer dereference.
How severe is CVE-2020-14396?
CVE-2020-14396 is considered high severity with a CVSS score of 7.5.
Which software packages are affected by CVE-2020-14396?
The affected software packages include libvncserver in Debian and Ubuntu, as well as the Libvnc Project Libvncserver.
How can I fix CVE-2020-14396?
To fix CVE-2020-14396, you should update to version 0.9.13 or later of LibVNCServer.
Where can I find more information about CVE-2020-14396?
You can find more information about CVE-2020-14396 on the CVE details page and the LibVNCServer GitHub repository.