[USN-4547-2] SSVNC vulnerabilities

Mike Salvatore mike.salvatore at canonical.com
Mon Sep 28 20:04:25 UTC 2020

Ubuntu Security Notice USN-4547-2
September 28, 2020

ssvnc vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS


Several security issues were fixed in SSVNC.

Software Description:
- ssvnc: Enhanced TightVNC viewer with SSL/SSH tunnel helper


It was discovered that the LibVNCClient vendored in SSVNC incorrectly handled
certain packet lengths. A remote attacker could possibly use this issue to
obtain sensitive information, cause a denial of service, or execute arbitrary
code. (CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-2024)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  ssvnc                           1.0.29-2+deb8u1build0.16.04.1

In general, a standard system update will make all the necessary changes.

  CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20024

Package Information:

More information about the ubuntu-security-announce mailing list