CVE-2017-18635: Canonical Ubuntu Linux

Medium severity, CVSS 6.1. EPSS: 4.8% chance of exploitation in the next 30 days.

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Affected products

• Canonical Ubuntu Linux: version 16.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Novnc Novnc: before 0.6.2 (fixed in 0.6.2)
• Red Hat Openstack: version 13 only

Published 2019-09-25. Last modified 2026-06-17.