Published: 15/12/2014 Updated: 23/10/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and previous versions does not properly handle attempts to send a large amount of ClientCutText data, which allows remote malicious users to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libvncserver libvncserver
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
debian debian linux 7.0

Debian Bug report logs - #762745 [CVE-2014-6051 to CVE-2014-6055] Multiple issues in libVNCserver Package: libvncserver; Maintainer for libvncserver is Peter Spiess-Knafl <dev@spiessknaflat>; Reported by: Luciano Bello <luciano@debianorg> Date: Wed, 24 Sep 2014 21:24:02 UTC Severity: grave Tags: patch, security Fi ...

Several security issues were fixed in LibVNCServer ...

Several vulnerabilities have been discovered in libvncserver, a library to implement VNC server functionality These vulnerabilities might result in the execution of arbitrary code or denial of service in both the client and the server side For the stable distribution (wheezy), these problems have been fixed in version 099+dfsg-1+deb7u1 For the ...

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client ...

CWE-19 http://ubuntu.com/usn/usn-2365-1 http://www.openwall.com/lists/oss-security/2014/09/25/11 https://github.com/newsoft/libvncserver/commit/6037a9074d52b1963c97cb28ea1096c7c14cbf28 http://www.ocert.org/advisories/ocert-2014-007.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://secunia.com/advisories/61682 http://www.debian.org/security/2014/dsa-3081 http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html https://security.gentoo.org/glsa/201507-07 https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html https://usn.ubuntu.com/4573-1/https://usn.ubuntu.com/4587-1/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762745 https://usn.ubuntu.com/2365-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-6053

CVE-2014-6053

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect