CVE-2020-14397: 
NixOS vulnerability analysis and mitigation

CVE-2020-14397 is a vulnerability discovered in LibVNCServer before version 0.9.13, affecting the libvncserver/rfbregion.c file. The vulnerability was disclosed on June 17, 2020, and involves a NULL pointer dereference issue (CVE, Ubuntu).

The vulnerability exists in the libvncserver/rfbregion.c file where there are missing NULL pointer checks in several functions handling span operations. The issue was fixed by adding proper NULL pointer validation checks in the affected functions (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) (Ubuntu).

If exploited, this vulnerability could allow a remote attacker to cause the application to crash, resulting in a denial of service condition (USN-4434-1).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Ubuntu).

The vulnerability has been fixed in LibVNCServer version 0.9.13. Users are advised to upgrade to this version or apply appropriate security patches. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu (0.9.12+dfsg-9ubuntu0.2 for 20.04), Debian (0.9.11+dfsg-1.3~deb9u5), and Red Hat Enterprise Linux (Debian Advisory, USN-4434-1).