Heap use-after-free in LibVNCServer - CVE-2018-6307

Vulnerability identifier: #VU17126

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-6307

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap use-after-free error in server code of file transfer extension. A remote attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

LibVNCServer
Ubuntu
Opensuse
libvncserver0 (Ubuntu package)
libvncserver (Debian package)
libvncclient1 (Ubuntu package)
libvncserver1 (Ubuntu package)

Update to version 0.9.12.

LibVNCServer - update to 0.9.12
libvncserver0 (Ubuntu package) - update to 0.9.9+dfsg-1ubuntu1.4
libvncserver (Debian package) - addressed in versions 0.9.9+dfsg2-6.1+deb8u5, 0.9.11+dfsg-1.3~deb9u1
libvncclient1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.3, 0.9.11+dfsg-1ubuntu1.1, 0.9.11+dfsg-1.1ubuntu0.1
libvncserver1 (Ubuntu package) - addressed in versions 0.9.10+dfsg-3ubuntu0.16.04.3, 0.9.11+dfsg-1ubuntu1.1, 0.9.11+dfsg-1.1ubuntu0.1

• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-026-libvnc-heap-use-after-free/

• Multiple vulnerabilities in LibVNCServer
• OpenSUSE Linux update for LibVNCServer
• Debian update for libvncserver
• Ubuntu update for libvncserver