CVE-2014-6052 The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of servi...
HighCVSS 7.5
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libvncserver(Debian:12) | < 0.9.9+dfsg-6.1 | 0.9.9+dfsg-6.1 |
| debian/libvncserver(Debian:13) | < 0.9.9+dfsg-6.1 | 0.9.9+dfsg-6.1 |
| debian/libvncserver(Debian:14) | < 0.9.9+dfsg-6.1 | 0.9.9+dfsg-6.1 |
| debian/veyon(Debian:12) | < 4.1.4+repack1-1 | 4.1.4+repack1-1 |
| debian/veyon(Debian:13) | < 4.1.4+repack1-1 | 4.1.4+repack1-1 |
| libvncserver | <= 0.9.9 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
References
- Debian Security Tracker CVE-2014-6052 vendor-advisory
- openSUSE-SU-2015:2207 vendor-advisory
- [oss-security] 20140923 Multiple issues in libVNCserver mailing-list third-party-advisory
- 61506 permissions-required third-party-advisory
- 61682 permissions-required third-party-advisory
- USN-2365-1 third-party-advisory vendor-advisory
- DSA-3081 third-party-advisory vendor-advisory
- www.ocert.org third-party-advisory us-government-resource
- [oss-security] 20140925 [oCERT-2014-007] libvncserver multiple issues mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- 70091 vdb-entry
- github.com exploit issue-tracking patch
- [debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update mailing-list
- GLSA-201507-07 vendor-advisory
- USN-4587-1 vendor-advisory
- bugs.debian.org issue-tracking