CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2014-6052 – libvncserver: NULL pointer dereference flaw in framebuffer setup
https://notcve.org/view.php?id=CVE-2014-6052
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message. La función HandleRFBServerMessage en libvncclient/rfbproto.c en LibVNCServer 0.9.9 y anteriores no comprueba ciertos valores de retorno malloc, lo que permite a servidores remotos VNC causar una denegación de servicio (caída de la aplicación) o posiblemente ejecutar código arbitrario mediante la especificación de un tamaño de pantalla grande en un mensaje (1) FramebufferUpdate, (2) ResizeFrameBuffer, o (3) PalmVNCReSizeFrameBuffer. A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash. • http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://secunia.com/advisories/61682 http://ubuntu.com/usn/usn-2365-1 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists/oss-security/2014/09/25/11 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.securityfocus. • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 2%CPEs: 6EXPL: 0CVE-2014-6055 – libvncserver: server stacked-based buffer overflow flaws in file transfer handling
https://notcve.org/view.php?id=CVE-2014-6055
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message. Múltiples desbordamientos de buffer basado en pila en la caracteristica File Transfer en rfbserver.c en LibVNCServer 0.9.9 y anteriores permiten a usuarios remotos autenticados causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un (1) fichero largo o (2) nombre de directorio o el (3) atributo FileTime en un mensaje rfbFileTransferOffer. Two stack-based buffer overflow flaws were found in the way LibVNCServer handled file transfers. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client. • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-0113.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 6.0EPSS: 11%CPEs: 4EXPL: 0CVE-2014-6053 – libvncserver: server NULL pointer dereference flaw in ClientCutText message handling
https://notcve.org/view.php?id=CVE-2014-6053
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc. La función rfbProcessClientNormalMessage en libvncserver/rfbserver.c en LibVNCServer 0.9.9 y anteriores no maneja correctamente los intentos de enviar una cantidad grande de datos ClientCutText, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria o caída del demonio) a través de un mensaje manipulado que está procesado mediante el uso de un único malloc no comprobado. A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. • http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://secunia.com/advisories/61682 http://ubuntu.com/usn/usn-2365-1 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists/oss-security/2014/09/25/11 https://github.com/newsoft/libvncserver/commit/6037a9074d52b1963c97cb28ea1096c7c14cbf28 https://lists.debian.org • CWE-19: Data Processing Errors CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2014-6051 – libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling
https://notcve.org/view.php?id=CVE-2014-6051
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow. Desbordamiento de enteros en la función MallocFrameBuffer en vncviewer.c en LibVNCServer 0.9.9 y anteriores permite a servidores remotos VNC causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un anuncio para un tamaño grande de pantalla, lo que provoca un desbordamiento de buffer basado en memoria dinámica. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way screen sizes were handled by LibVNCServer. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code in the client. • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-0113.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists& • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 6.0EPSS: 80%CPEs: 4EXPL: 0CVE-2014-6054 – libvncserver: server divide-by-zero flaw in scaling factor handling
https://notcve.org/view.php?id=CVE-2014-6054
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message. La función rfbProcessClientNormalMessage en libvncserver/rfbserver.c en LibVNCServer 0.9.9 y anteriores permite a atacantes remotos causar una denegación de servicio (error de la división por cero y caída del servidor) a través de un valor cero en el factor de escalado en un mensaje (1) PalmVNCSetScaleFactor o (2) SetScale. A divide-by-zero flaw was found in the way LibVNCServer handled the scaling factor when it was set to "0". A remote attacker could use this flaw to crash the VNC server using a malicious VNC client. • http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://secunia.com/advisories/61682 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists/oss-security/2014/09/25/11 http://www.securityfocus.com/bid/70094 http://www.ubuntu.com/usn/USN-2365-1 https://github.com/newsoft/libvncserver/commit/05a9bd41a8ec • CWE-189: Numeric Errors CWE-369: Divide By Zero •