CVE-2018-20750 : What You Need to Know

A heap out-of-bounds write vulnerability in libvncserver versions 0.9.12 and earlier, with an incomplete fix from CVE-2018-15127.

Understanding CVE-2018-20750

What is CVE-2018-20750?

LibVNC through version 0.9.12 is susceptible to a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c.

The Impact of CVE-2018-20750

The incomplete fix for CVE-2018-15127 leaves systems vulnerable to potential exploitation through this heap out-of-bounds write vulnerability.

Technical Details of CVE-2018-20750

Vulnerability Description

The vulnerability exists in the file rfbserver.c of libvncserver versions 0.9.12 and prior, allowing for a heap out-of-bounds write.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions affected: 0.9.12 and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability to write beyond the allocated memory, potentially leading to arbitrary code execution.

Mitigation and Prevention

Immediate Steps to Take

Apply the latest security update provided by the vendor.
Monitor vendor advisories and security mailing lists for any further updates.

Long-Term Security Practices

Regularly update software and systems to patch known vulnerabilities.
Implement network segmentation and access controls to limit the impact of potential attacks.

Patching and Updates

Utilize the security updates released by LibVNC to address this vulnerability.