CVE-2019-20788 - CVE House
Back to Database
Status published Critical CVE-2019-20788

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow...

Vulnerability Description

libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20788

Credits & Attribution

No credits recorded in the NVD database.

References

More from libvnc project

View All →
CVE-2020-14405
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does...
Medium 6.5
CVE-2020-14404
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows...
Medium 5.4
CVE-2020-14403
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows...
Medium 5.4
CVE-2020-14402
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows...
Medium 5.4
CVE-2020-14398
An issue was discovered in LibVNCServer before 0.9.13. An improperly...
High 7.5

Affected Vendor

libvnc project

View all reports →

Affected Software

libvncserver, ubuntu linux, debian linux, simatic itc1500 firmware, simatic itc1500 pro firmware, simatic itc1900 firmware, simatic itc1900 pro firmware, simatic itc2200 firmware, simatic itc2200 pro firmware
Vulnerable Versions:
0, 14.04, 16.04, 18.04, 18.10, 8.0, 9.0, 3.0.0.0

Timeline

Official Publish: April 23rd, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.