CVE-2019-20840
- Source
- https://cve.org/CVERecord?id=CVE-2019-20840
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20840.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-20840
- Downstream
- Related
- Published
- 2020-06-17T16:15:11.523Z
- Modified
- 2026-07-08T20:29:39.169799Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc1500_firmware" }, { "cpes": [ "cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc1500_pro_firmware" }, { "cpes": [ "cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc1900_firmware" }, { "cpes": [ "cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc1900_pro_firmware" }, { "cpes": [ "cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc2200_firmware" }, { "cpes": [ "cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE", "extracted_events": [ { "introduced": "3.0.0.0" }, { "fixed": "3.2.1.0" } ], "vendor_product": "siemens:simatic_itc2200_pro_firmware" }, { "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "14.04" }, { "last_affected": "14.04" }, { "introduced": "16.04" }, { "last_affected": "16.04" }, { "introduced": "16.04" }, { "last_affected": "16.04" }, { "introduced": "18.04" }, { "last_affected": "18.04" }, { "introduced": "18.10" }, { "last_affected": "18.10" }, { "introduced": "20.04" }, { "last_affected": "20.04" } ], "vendor_product": "canonical:ubuntu_linux" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" }, { "introduced": "9.0" }, { "last_affected": "9.0" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "15.2" }, { "last_affected": "15.2" } ], "vendor_product": "opensuse:leap" } ] }- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
- https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
- https://usn.ubuntu.com/4434-1/
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
- https://github.com/LibVNC/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76
Affected packages
Git / github.com/libvnc/libvncserver
Affected ranges
- Type
- GIT
- Repo
- https://github.com/libvnc/libvncserver
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "last_affected": "0.9.12" } ] }
Affected versions
LibVNCServer-0.*
LibVNCServer-0.9.10
LibVNCServer-0.9.11
LibVNCServer-0.9.12
LibVNCServer-0.9.8
LibVNCServer-0.9.9
Other
X11VNC_0_9_10
X11VNC_0_9_11
X11VNC_0_9_12
X11VNC_0_9_7
X11VNC_0_9_8
X11VNC_0_9_9
X11VNC_REL_0_9_4
X11VNC_REL_0_9_5
X11VNC_REL_0_9_6
Database specific
vanir_signatures_modified
"2026-07-08T20:29:39Z"
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"file": "libvncserver/ws_decode.c",
"function": "hybiReadAndDecode"
},
"deprecated": false,
"source": "https://github.com/libvnc/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76",
"id": "CVE-2019-20840-10709c66",
"signature_version": "v1",
"digest": {
"function_hash": "180079713415210745791807162750284308920",
"length": 4063.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libvncserver/ws_decode.c"
},
"deprecated": false,
"source": "https://github.com/libvnc/libvncserver/commit/0cf1400c61850065de590d403f6d49e32882fd76",
"id": "CVE-2019-20840-337dc46d",
"signature_version": "v1",
"digest": {
"line_hashes": [
"280535027786460026972189112772063445853",
"50701751959996758734036103654922009095",
"152558449667183412663568482169208692828",
"327930894662464802945272025504953063997",
"187881109947118880620593900587007315645",
"215302365506936472057092840460876039458",
"50659555013314031717534322792322098385",
"184898503279201702730802996537756075167",
"96434419174010811701165366566747251317",
"176232627971923197157543118542926500038"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20840.json"