High
Security advisory
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-14397
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:33 UTC · Revision 1
Source evidence
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
osv:CVE-2020-14397
Complete source record
{
"id": "fe2b9edbfa4db015d5012e3ef1010c681940e98c66d63cf9c07ecc5c79c42918",
"url": "https://osv.dev/vulnerability/CVE-2020-14397",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-14397",
"summary": "An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.",
"evidence": "osv:CVE-2020-14397",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-14397",
"aliases": [
"CVE-2020-14397"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libvnc/libvncserver",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0a70095271d845d16a3ed17354841b01f33963ad"
},
{
"fixed": "38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libvnc_project:libvncserver:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.9.12"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"LibVNCServer-0.9.12",
"LibVNCServer-0.9.11",
"LibVNCServer-0.9.10",
"LibVNCServer-0.9.9",
"LibVNCServer-0.9.8",
"X11VNC_0_9_12",
"X11VNC_0_9_11",
"X11VNC_0_9_10",
"X11VNC_0_9_9",
"X11VNC_0_9_8",
"X11VNC_0_9_7",
"X11VNC_REL_0_9_6",
"X11VNC_REL_0_9_5",
"X11VNC_REL_0_9_4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-14397.json",
"vanir_signatures": [
{
"id": "CVE-2020-14397-57138274",
"digest": {
"length": 564,
"function_hash": "297202612131400419264101244022029335570"
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbserver.c",
"function": "rfbClientIteratorNext"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-62fecc1c",
"digest": {
"length": 129,
"function_hash": "35943597304556728290599649561873686848"
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbregion.c",
"function": "sraSpanRemove"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-7db584a1",
"digest": {
"length": 177,
"function_hash": "13375577804589520980869365028992005452"
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbregion.c",
"function": "sraSpanInsertBefore"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-b286e04f",
"digest": {
"length": 177,
"function_hash": "308180803968003756632479985064601731480"
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbregion.c",
"function": "sraSpanInsertAfter"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-c6e68006",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129789622784888703049761371788375090829",
"192021373110556373924439968139735438884",
"61072920218535349534747548085317793870",
"290028638275504518166892205271637573622",
"309529031156275530272242272036928506489",
"63814239015190438186515325761625769582",
"305345191105789934771957096566624699162",
"164856137291477852452065722557293518470",
"258276280196864558935373940393721172142",
"260530719255116134297278517836890348386",
"219211903808393606215952572397156439919",
"164379770128048257586355656012362062922",
"49864376157076557018843636422687187024",
"326415775950170687086498577993376834425",
"176015776013475282985826867223578781969",
"188226683699824686304425512567088681309",
"87338811101464322177305173082397686098",
"338038670024466485237077130119798763896",
"200654883490875339150761829742367690988"
]
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbregion.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-dcee1ebf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"188611924461224704302489486341034162652",
"45100662802048171843781279201327666989",
"228183687346468758546468784391674645379",
"112246271884870165818073004635834463683",
"322962774470696617483175220566020184863",
"276446598387385854228408982083396903462",
"318670290681636359680857980044567325665",
"28880945584438269491008089576739099616"
]
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbserver.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-14397-ddcdae11",
"digest": {
"length": 105,
"function_hash": "57427340694778193739664377224873694190"
},
"source": "https://github.com/libvnc/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0",
"target": {
"file": "libvncserver/rfbserver.c",
"function": "rfbReleaseClientIterator"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:50:31Z"
}
}
],
"modified": "2026-10-20T13:50:31.615264471Z",
"provider": "osv",
"references": [
"https://github.com/LibVNC/libvncserver/compare/LibVNCServer-0.9.12...LibVNCServer-0.9.13",
"https://lists.debian.org/debian-lts-announce/2020/06/msg00035.html",
"https://lists.debian.org/debian-lts-announce/2020/08/msg00045.html",
"https://usn.ubuntu.com/4434-1/",
"https://usn.ubuntu.com/4573-1/",
"https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf",
"https://github.com/LibVNC/libvncserver/commit/38e98ee61d74f5f5ab4aa4c77146faad1962d6d0"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc1500_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc1500_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc1500_pro_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc1500_pro_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc1900_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc1900_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc1900_pro_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc1900_pro_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc2200_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc2200_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:siemens:simatic_itc2200_pro_firmware:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:simatic_itc2200_pro_firmware",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0.0"
},
{
"fixed": "3.2.1.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.2"
},
{
"last_affected": "15.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-14397",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388270,
"published_at": "2020-06-17T16:15:11.773+00:00"
}