Heap out-of-bounds write in LibVNCServer - CVE-2018-15127

Vulnerability identifier: #VU17122

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15127

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap out-of-bounds write in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

LibVNCServer
libvncserver (Debian package)
italc-client (Ubuntu package)
italc-master (Ubuntu package)
libitalccore (Ubuntu package)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power
Opensuse
Ubuntu

Update to version 0.9.12.

LibVNCServer - update to 0.9.12
libvncserver (Debian package) - addressed in versions 0.9.9+dfsg2-6.1+deb8u5, 0.9.11+dfsg-1.3~deb9u1
italc-client (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1
italc-master (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1
libitalccore (Ubuntu package) - update to 1:3.0.3+dfsg1-3ubuntu0.1

• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-028-libvnc-heap-out-of-bound-write/

• Multiple vulnerabilities in LibVNCServer
• OpenSUSE Linux update for LibVNCServer
• Debian update for libvncserver
• Red Hat update for libvncserver
• Ubuntu update for italc