Vulnerability · Published Nov 25, 2020 · Assigned by mitre
CVE-2020-29074
High 8.8
In plain English
A high-severity security flaw in the x11vnc package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.8%top 21.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | x11vnc | 0.9.16-r2 | ALPINE-CVE-2020-29074 |
| Alpine:v3.21 | x11vnc | 0.9.16-r2 | ALPINE-CVE-2020-29074 |
| Alpine:v3.22 | x11vnc | 0.9.16-r2 | ALPINE-CVE-2020-29074 |
| Alpine:v3.23 | x11vnc | 0.9.16-r2 | ALPINE-CVE-2020-29074 |
| Alpine:v3.24 | x11vnc | 0.9.16-r2 | ALPINE-CVE-2020-29074 |
| Debian:12 | x11vnc | 0.9.16-5 | DEBIAN-CVE-2020-29074 |
| Debian:13 | x11vnc | 0.9.16-5 | DEBIAN-CVE-2020-29074 |
| Debian:14 | x11vnc | 0.9.16-5 | DEBIAN-CVE-2020-29074 |
Affected products (as reported)
References
- https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a x_refsource_MISC
- DSA-4799 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2490-1] x11vnc security update mailing-list, x_refsource_MLIST
- FEDORA-2021-c5b679877e vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-93911302d6 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-069c0c3950 vendor-advisory, x_refsource_FEDORA