CVE-2020-29260

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

The product does not properly control the allocation and maintenance of a limited resource.

Name	Vendor	Start Version	End Version
Libvncserver	Libvncserver_project	0.9.13 (including)	0.9.13 (including)
Italc	Ubuntu	bionic	*
Italc	Ubuntu	trusty	*
Italc	Ubuntu	xenial	*
Libvncserver	Ubuntu	bionic	*
Libvncserver	Ubuntu	focal	*
Libvncserver	Ubuntu	kinetic	*
Libvncserver	Ubuntu	lunar	*
Libvncserver	Ubuntu	mantic	*
Libvncserver	Ubuntu	oracular	*
Libvncserver	Ubuntu	trusty	*
Libvncserver	Ubuntu	xenial	*
Tightvnc	Ubuntu	bionic	*
Tightvnc	Ubuntu	focal	*
Tightvnc	Ubuntu	kinetic	*
Tightvnc	Ubuntu	lunar	*
Tightvnc	Ubuntu	mantic	*
Tightvnc	Ubuntu	oracular	*
Tightvnc	Ubuntu	trusty	*
Tightvnc	Ubuntu	trusty/esm	*
Tightvnc	Ubuntu	xenial	*
Veyon	Ubuntu	focal	*
Veyon	Ubuntu	kinetic	*
Veyon	Ubuntu	lunar	*
Veyon	Ubuntu	mantic	*
Veyon	Ubuntu	oracular	*
Veyon	Ubuntu	trusty	*
Veyon	Ubuntu	xenial	*
Vino	Ubuntu	trusty	*
Vino	Ubuntu	xenial	*
X11vnc	Ubuntu	bionic	*
X11vnc	Ubuntu	focal	*
X11vnc	Ubuntu	kinetic	*
X11vnc	Ubuntu	lunar	*
X11vnc	Ubuntu	mantic	*
X11vnc	Ubuntu	oracular	*
X11vnc	Ubuntu	trusty	*
X11vnc	Ubuntu	trusty/esm	*
X11vnc	Ubuntu	xenial	*

Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-29260
CWE	https://cwe.mitre.org/data/definitions/400.html

Uncontrolled Resource Consumption