CVE-2020-14403: Medium severity Libvnc Project Libvncserver vulnerability
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13
Event History
Frequently Asked Questions
What is CVE-2020-14403?
CVE-2020-14403 is a vulnerability discovered in LibVNCServer before version 0.9.13 that allows out-of-bounds access via encodings.
What is the severity of CVE-2020-14403?
The severity of CVE-2020-14403 is medium, with a CVSS score of 5.4.
How does CVE-2020-14403 affect LibVNCServer?
CVE-2020-14403 affects LibVNCServer before version 0.9.13, allowing out-of-bounds access via encodings.
What software is affected by CVE-2020-14403?
The following software versions are affected: libvncserver 0.9.11+dfsg-1.3+deb10u4, libvncserver 0.9.11+dfsg-1.3+deb10u5, libvncserver 0.9.13+dfsg-2+deb11u1, libvncserver 0.9.14+dfsg-1, libvncserver 0.9.12+dfsg-9ubuntu0.2, vino 3.22.0-6ubuntu2, vino 3.22.0-3ubuntu1.1, vino 3.22.0-5ubuntu2.1, vino 3.8.1-0ubuntu9.3.
How do I fix CVE-2020-14403?
To fix CVE-2020-14403, you should update your LibVNCServer installation to version 0.9.13 or later.