CVE-2020-14401: Integer Overflow
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixelvalue integer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
alpine/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13-r0 - Upgrade
Upgrade
libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-14401.
What is the severity of CVE-2020-14401?
The severity of CVE-2020-14401 is medium with a CVSS score of 6.5.
How does CVE-2020-14401 impact LibVNCServer?
CVE-2020-14401 allows attackers to cause a pixel_value integer overflow in LibVNCServer before version 0.9.13.
What is the remedy for CVE-2020-14401 in Debian?
The remedy for CVE-2020-14401 in Debian is to update to version 0.9.13+dfsg-2+deb11u1 or later.
What is the remedy for CVE-2020-14401 in Ubuntu?
The remedy for CVE-2020-14401 in Ubuntu is to update to version 0.9.12+dfsg-9ubuntu0.2 or later.