CVE-2019-20840
- Source
- https://cve.org/CVERecord?id=CVE-2019-20840
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20840.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-20840
- Downstream
- Related
- Published
- 2020-06-17T16:15:11.523Z
- Modified
- 2026-03-15T22:28:16.381423Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- https://usn.ubuntu.com/4434-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
Affected packages
Git / github.com/libvnc/libvncserver
Affected versions
LibVNCServer-0.*
LibVNCServer-0.9.10
LibVNCServer-0.9.11
LibVNCServer-0.9.12
LibVNCServer-0.9.8
LibVNCServer-0.9.9
Other
X11VNC_0_9_10
X11VNC_0_9_11
X11VNC_0_9_12
X11VNC_0_9_7
X11VNC_0_9_8
X11VNC_0_9_9
X11VNC_REL_0_9_4
X11VNC_REL_0_9_5
X11VNC_REL_0_9_6
Database specific
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "20.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "15.2"
}
]
}
]
vanir_signatures
[
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "libvncserver/ws_decode.c",
"function": "hybiReadAndDecode"
},
"id": "CVE-2019-20840-10709c66",
"deprecated": false,
"source": "https://github.com/libvnc/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76",
"digest": {
"function_hash": "180079713415210745791807162750284308920",
"length": 4063.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "libvncserver/ws_decode.c"
},
"id": "CVE-2019-20840-337dc46d",
"deprecated": false,
"source": "https://github.com/libvnc/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76",
"digest": {
"line_hashes": [
"280535027786460026972189112772063445853",
"50701751959996758734036103654922009095",
"152558449667183412663568482169208692828",
"327930894662464802945272025504953063997",
"187881109947118880620593900587007315645",
"215302365506936472057092840460876039458",
"50659555013314031717534322792322098385",
"184898503279201702730802996537756075167",
"96434419174010811701165366566747251317",
"176232627971923197157543118542926500038"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20840.json"