CVE-2017-18922
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LibVNCServer是一款支持在程序中实现VNC（虚拟网络计算）服务器或客户端功能的跨平台C语言库。 LibVNCServer 9.12之前版本中的websockets.c文件存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-18922
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
LibVNCServer 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
LibVNCServer是一款支持在程序中实现VNC（虚拟网络计算）服务器或客户端功能的跨平台C语言库。 LibVNCServer 9.12之前版本中的websockets.c文件存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2017-18922
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-18922
请登录查看更多情报信息。
Patches & Fixes for CVE-2017-18922 (1)
Vendor Advisories for CVE-2017-18922 (3)
-
https://bugzilla.redhat.com/show_bug.cgi?id=1852356 x_refsource_MISC
-
https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf x_refsource_CONFIRM
-
Mailing List Discussions for CVE-2017-18922 (9)
-
https://www.openwall.com/lists/oss-security/2020/06/30/2 x_refsource_MISC
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00028.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00020.html vendor-advisory x_refsource_SUSE
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F6FUH4EFK4NAP6GT4TQRTBKWIRCZLIY/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVP7TJVYJDXDFRHVQ3ENEN3H354QPXEZ/ vendor-advisory x_refsource_FEDORA
-
Same Patch Batch · n/a · 2020-06-30 · 22 CVEs total
| CVE-2020-15049 | 9.9 CRITICAL | Squid 环境问题漏洞 |
| CVE-2020-14956 | Windows cleaning assistant 输入验证错误漏洞 | |
| CVE-2020-15395 | MediaArea MediaInfo 缓冲区错误漏洞 | |
| CVE-2020-15396 | iFAX Solutions HylaFAX+和HylaFAX Enterprise 安全漏洞 | |
| CVE-2020-15397 | iFAX Solutions HylaFAX+和HylaFAX Enterprise 安全漏洞 | |
| CVE-2019-20893 | Activision Infinity Ward Call of Duty Modern Warfare 2 缓冲区错误漏洞 | |
| CVE-2020-15400 | CakePHP 跨站请求伪造漏洞 | |
| CVE-2020-15401 | IOBit Malware Fighter Pro 后置链接漏洞 | |
| CVE-2020-15411 | MISP 安全漏洞 | |
| CVE-2020-15412 | MISP 安全漏洞 | |
| CVE-2020-15415 | DrayTek Vigor3900、Vigor2960和Vigor300B 操作系统命令注入漏洞 | |
| CVE-2020-9483 | Apache SkyWalking SQL注入漏洞 | |
| CVE-2020-14947 | OCS Inventory NG 操作系统命令注入漏洞 | |
| CVE-2020-14957 | Windows cleaning assistant 输入验证错误漏洞 | |
| CVE-2020-13095 | Objective Development Software Little Snitch 后置链接漏洞 | |
| CVE-2020-14482 | Delta Electronics Industrial Automation DOPSoft 缓冲区错误漏洞 | |
| CVE-2020-15307 | Nozomi Networks Guardian 跨站脚本漏洞 | |
| CVE-2020-14474 | Cellebrite UFED 信任管理问题漏洞 | |
| CVE-2020-14059 | Squid 安全漏洞 | |
| CVE-2020-14058 | Squid 代码问题漏洞 |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2017-18922
No comments yet