cbcvebase.
CVE-2018-15127
published 2018-12-19

CVE-2018-15127: LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can…

PriorityP262critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
15.09%
96.4th percentile
LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debianlibvncserver< libvncserver 0.9.11+dfsg-1.2 (bookworm)libvncserver 0.9.11+dfsg-1.2 (bookworm)
debianlibvncserver< libvncserver 0.9.11+dfsg-1.3 (bookworm)libvncserver 0.9.11+dfsg-1.3 (bookworm)
libvnc_projectlibvncserver< 0.9.120.9.12
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.30.9.11+dfsg-1.3
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.20.9.11+dfsg-1.2
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.30.9.11+dfsg-1.3
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.20.9.11+dfsg-1.2
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.30.9.11+dfsg-1.3
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.20.9.11+dfsg-1.2
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.30.9.11+dfsg-1.3
libvncserver_projectlibvncserver>= 0 < 0.9.11+dfsg-1.20.9.11+dfsg-1.2
redhatenterprise_linux_desktop
redhatenterprise_linux_server
redhatenterprise_linux_server_aus
redhatenterprise_linux_server_eus
redhatenterprise_linux_server_tus
redhatenterprise_linux_workstation
siemenssimatic_itc1500_firmware>= 3.0.0.0 < 3.2.1.03.2.1.0
siemenssimatic_itc1500_pro_firmware>= 3.0.0.0 < 3.2.1.03.2.1.0

Detection & IOCsextracted from sources · hover to see the quote

pathlibvncserver/rfbserver.c
hash502821828ed00b4a2c4bef90683d0fd88ce495de
  • Vulnerable function is rfbProcessFileTransferReadBuffer() in libvncserver/rfbserver.c — monitor for heap out-of-bounds write activity triggered via the VNC file transfer extension on the server side.
  • The vulnerability is exploitable remotely via the VNC file transfer extension; inspect VNC traffic for anomalous file transfer protocol messages that could trigger the heap write primitive.
  • ·The initial fix (commit 502821828ed00b4a2c4bef90683d0fd88ce495de) for CVE-2018-15127 was incomplete; follow-on CVEs (CVE-2018-20749, CVE-2018-20750) track the remaining exposure through LibVNC 0.9.12. Ensure patching covers all three CVEs.
  • ·Red Hat Enterprise Linux 6 is listed as 'Will not fix' for CVE-2018-15127; systems running RHEL 6 with libvncserver remain permanently exposed unless mitigated at the network/application layer.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.