CVE-2020-14398: High severity Libvnc Project Libvncserver vulnerability
Published Jun 17, 2020
·Updated
An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.
Affected Software
35 affected componentsFixes available
Libvnc Project Libvncserver<=0.9.12
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Canonical Ubuntu Linux=20.04
Debian Debian Linux=8.0
Debian Debian Linux=9.0
All of the following
Siemens Simatic Itc1500 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1500
All of the following
Siemens Simatic Itc1500 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1500 Pro
All of the following
Siemens Simatic Itc1900 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1900
All of the following
Siemens Simatic Itc1900 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1900 Pro
All of the following
Siemens Simatic Itc2200 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc2200
All of the following
Siemens Simatic Itc2200 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc2200 Pro
openSUSE Leap=15.2
Siemens Simatic Itc1500 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1500
Siemens Simatic Itc1500 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1500 Pro
Siemens Simatic Itc1900 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1900
Siemens Simatic Itc1900 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc1900 Pro
Siemens Simatic Itc2200 Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc2200
Siemens Simatic Itc2200 Pro Firmware>=3.0.0.0<3.2.1.0
Siemens Simatic Itc2200 Pro
debian/libvncserver
0.9.13+dfsg-2+deb11u10.9.14+dfsg-1+deb12u10.9.15+dfsg-1+deb13u10.9.15+dfsg-6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6
Event History
Jun 17, 2020
CVE Published
via MITRE·03:13 PM
Data Sourced
via MITRE·03:13 PM
Description
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:40 PM
Description
Jul 21, 2025
Data Sourced
via Ubuntu·04:05 AM
RemedyDescriptionSeverityAffected Software
Jul 5, 2026
Data Sourced
via Debian·02:52 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2020-14398?
CVE-2020-14398 is a vulnerability in LibVNCServer that allows an infinite loop to occur due to an improperly closed TCP connection.
2
What is the severity of CVE-2020-14398?
CVE-2020-14398 has a severity rating of 7.5 (High).
3
How does CVE-2020-14398 impact LibVNCServer?
CVE-2020-14398 can cause an infinite loop in the libvncclient/sockets.c file of LibVNCServer.
4
Which versions of LibVNCServer are affected by CVE-2020-14398?
LibVNCServer versions up to and including 0.9.12 are affected by CVE-2020-14398.
5
How can I fix CVE-2020-14398?
To fix CVE-2020-14398, update LibVNCServer to version 0.9.13 or later.