libvncserver-devel (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package libvncserver-devel, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2017-18922 — CVSS 9.8 (critical): It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker…
• CVE-2018-21247 — CVSS 7.5 (high): An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the…
• CVE-2019-20839 — CVSS 7.5 (high): libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
• CVE-2020-14397 — CVSS 7.5 (high): An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
• CVE-2020-25708 — CVSS 7.5 (high): A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted…
• CVE-2020-14405 — CVSS 6.5 (medium): An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.