Use-after-free in LibVNCServer - CVE-2018-15126

Vulnerability identifier: #VU16962

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15126

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a heap use-after-free error in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

LibVNCServer
Ubuntu
Opensuse
libvncserver0 (Ubuntu package)
libvncserver (Debian package)
libvncclient1 (Ubuntu package)
libvncserver1 (Ubuntu package)

Update to version 0.9.12.

LibVNCServer - update to 0.9.12
libvncserver0 (Ubuntu package) - update to 0.9.9+dfsg-1ubuntu1.4
libvncserver (Debian package) - addressed in versions 0.9.9+dfsg2-6.1+deb8u5, 0.9.11+dfsg-1.3~deb9u1
libvncclient1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.3, 0.9.11+dfsg-1ubuntu1.1, 0.9.11+dfsg-1.1ubuntu0.1
libvncserver1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.3, 0.9.11+dfsg-1ubuntu1.1, 0.9.11+dfsg-1.1ubuntu0.1

• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-027-libvnc-heap-use-after-free/

• Multiple vulnerabilities in LibVNCServer
• OpenSUSE Linux update for LibVNCServer
• Debian update for libvncserver
• Ubuntu update for libvncserver