CVE-2020-25708: Divide by Zero
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.
Other sources
An issue was discovered in libvncserver-0.9.12. There is a divide by zero in rfbSendRectEncodingRaw function in libvncserver/rfbserver.c. Attackers can launch a denial of service attack by sending a special message to the VNC server.
Upstream issue: https://github.com/LibVNC/libvncserver/issues/409
Upstream commit: https://github.com/LibVNC/libvncserver/commit/673c07a75ed844d74676f3ccdcfdc706a7052dba
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25708?
CVE-2020-25708 is a divide by zero vulnerability in libvncserver-0.9.12.
What is the severity of CVE-2020-25708?
CVE-2020-25708 has a severity value of 7.5 (high).
How does CVE-2020-25708 impact the VNC server?
CVE-2020-25708 allows a malicious client to send a specially crafted message that triggers a divide by zero, leading to a floating point exception and denial of service.
How can I mitigate CVE-2020-25708?
To mitigate CVE-2020-25708, update libvncserver to version 0.9.13.
Where can I find more information about CVE-2020-25708?
You can find more information about CVE-2020-25708 in the references section: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1896739), [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2022/09/msg00035.html), [GitHub Issue](https://github.com/LibVNC/libvncserver/issues/409).