What’s Vulnerable › Vulnerabilities

CVE-2020-14399

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-17 · updated 2026-06-17

Description

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 20.04
• Debian Linux: 8.0, 9.0
• LibVNCServer: before 0.9.13 — fixed in 0.9.13
• openSUSE Leap: 15.1, 15.2

How to fix

Upgrade to a fixed version: LibVNCServer 0.9.13. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1860354
• https://github.com/LibVNC/libvncserver/commit/23e5cbe6b090d7f22982aee909a6a618174d3c2d
• https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13
• https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html
• https://usn.ubuntu.com/4434-1/
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html

Get alerted when CVE-2020-14399 or the next vulnerability affects your stack