NetSight
IP …
critical9.8

CVE-2017-18922

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames.

Impact

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

Affected products

VendorProductAffected versions
Libvncserver ProjectLibvncserver
before 0.9.12
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.10, 20.04
OpensuseLeap
Versions 15.1, 15.2
FedoraprojectFedora
Versions 31, 32
SiemensSimatic Itc1500 Firmware
from 3.0.0.0 before 3.2.1.0
SiemensSimatic Itc1500 Pro Firmware
from 3.0.0.0 before 3.2.1.0
SiemensSimatic Itc1900 Firmware
from 3.0.0.0 before 3.2.1.0
SiemensSimatic Itc1900 Pro Firmware
from 3.0.0.0 before 3.2.1.0
SiemensSimatic Itc2200 Firmware
from 3.0.0.0 before 3.2.1.0
SiemensSimatic Itc2200 Pro Firmware
from 3.0.0.0 before 3.2.1.0

Weakness classification

CWE-787

References