CVE-2014-0011 Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vnc...
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vnc4(Debian:10) | < 4.1.1+X4.3.0+t-1 | 4.1.1+X4.3.0+t-1 |
| TigerVNC | < 1.3.1 | 1.3.1 |
| TigerVNC | = before 1.3.1 | No fix listed |
References
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com third-party-advisory
- Debian Security Tracker CVE-2014-0011 vendor-advisory