Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

LibVNCServer TCP Connection Infinite Loop

CVE-2020-14398 · published 6 years ago
Summary

An issue in LibVNCServer can cause a program to freeze or crash when handling a closed TCP connection. This is a potential security risk, as it could be exploited by an attacker. Update to the latest version of LibVNCServer to fix this issue.

What to do
  • Update canonical libvncserver to version 0.9.10+dfsg-3ubuntu0.16.04.5.
  • Update canonical libvncserver to version 0.9.11+dfsg-1ubuntu1.3.
  • Update canonical libvncserver to version 0.9.12+dfsg-9ubuntu0.2.
  • Update debian libvncserver to version 0.9.13+dfsg-1.
  • Update siemens simatic_itc1500_firmware to version 3.2.1.0 or later.
  • Update siemens simatic_itc1500_pro_firmware to version 3.2.1.0 or later.
  • Update siemens simatic_itc1900_firmware to version 3.2.1.0 or later.
  • Update siemens simatic_itc1900_pro_firmware to version 3.2.1.0 or later.
  • Update siemens simatic_itc2200_firmware to version 3.2.1.0 or later.
  • Update siemens simatic_itc2200_pro_firmware to version 3.2.1.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– libvnc_project libvncserver <= 0.9.12
cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 14.04
16.04
18.04
18.10
20.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
– debian debian_linux 8.0
9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
– siemens simatic_itc1500_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*
– siemens simatic_itc1500_pro_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*
– siemens simatic_itc1900_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*
– siemens simatic_itc1900_pro_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*
– siemens simatic_itc2200_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*
– siemens simatic_itc2200_pro_firmware >= 3.0.0.0, < 3.2.1.0
cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*
– opensuse leap 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Ubuntu:14.04:LTS canonical x11vnc All versions
Ubuntu:16.04:LTS canonical libvncserver < 0.9.10+dfsg-3ubuntu0.16.04.5
Fix: upgrade to 0.9.10+dfsg-3ubuntu0.16.04.5
Ubuntu:18.04:LTS canonical libvncserver < 0.9.11+dfsg-1ubuntu1.3
Fix: upgrade to 0.9.11+dfsg-1ubuntu1.3
Ubuntu:20.04:LTS canonical libvncserver < 0.9.12+dfsg-9ubuntu0.2
Fix: upgrade to 0.9.12+dfsg-9ubuntu0.2
Ubuntu:20.04:LTS canonical veyon All versions
Debian:12 debian libvncserver < 0.9.13+dfsg-1
Fix: upgrade to 0.9.13+dfsg-1
Original advisory text
An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.
An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published17 Jun 2020
Updated2 Nov 2026
First seen4 Aug 2026
Sources
CVE-2020-14398 · OSV
CVE-2020-14398 · NVD
UBUNTU-CVE-2020-14398 · OSV
DEBIAN-CVE-2020-14398 · OSV
Track software like this
Free during beta