CVSS: 9.8EPSS: 1%CPEs: 14EXPL: 1CVE-2018-7225 – libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c
https://notcve.org/view.php?id=CVE-2018-7225
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets. Se ha descubierto un problema en LibVNCServer hasta la versión 0.9.11. rfbProcessClientNormalMessage() en rfbserver.c no sanea msg.cct.length, lo que conduce a un acceso a datos no inicializados y potencialmente sensibles o, posiblemente, a otro tipo de impacto sin especificar (por ejemplo, un desbordamiento de enteros) mediante paquetes VNC especialmente manipulados. • http://www.openwall.com/lists/oss-security/2018/02/18/1 http://www.securityfocus.com/bid/103107 https://access.redhat.com/errata/RHSA-2018:1055 https://github.com/LibVNC/libvncserver/issues/218 https://lists.debian.org/debian-lts-announce/2018/03/msg00035.html https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html https://se • CWE-190: Integer Overflow or Wraparound CWE-805: Buffer Access with Incorrect Length Value •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9942
https://notcve.org/view.php?id=CVE-2016-9942
Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions. Desbordamiento de búfer basado en memoria dinámica en ultra.c en LibVNCClient en LibVNCServer en versiones anteriores a 0.9.11 permite a servidores remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario a través de un mensaje FramebufferUpdate manipulado con el título de tipo Ultra, de manera que la longitud de la carga útil LZO descomprimida excede lo especificado por las dimensiones del azulejo. • http://www.debian.org/security/2017/dsa-3753 http://www.securityfocus.com/bid/95170 https://github.com/LibVNC/libvncserver/pull/137 https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11 https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html https://security.gentoo.org/glsa/201702-24 https://usn.ubuntu.com/4587-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-9941
https://notcve.org/view.php?id=CVE-2016-9941
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area. Desbordamiento de búfer basado en memoria dinámica en rfbproto.c en LibVNCClient en LibVNCServer en versiones anteriores a 0.9.11 permite a servidores remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario a través de un mensaje FramebufferUpdate manipulado que contiene un subrectángulo fuera del área de dibujo del cliente. • http://www.debian.org/security/2017/dsa-3753 http://www.securityfocus.com/bid/95170 https://github.com/LibVNC/libvncserver/pull/137 https://github.com/LibVNC/libvncserver/releases/tag/LibVNCServer-0.9.11 https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html https://security.gentoo.org/glsa/201702-24 https://usn.ubuntu.com/4587-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2014-6052 – libvncserver: NULL pointer dereference flaw in framebuffer setup
https://notcve.org/view.php?id=CVE-2014-6052
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message. La función HandleRFBServerMessage en libvncclient/rfbproto.c en LibVNCServer 0.9.9 y anteriores no comprueba ciertos valores de retorno malloc, lo que permite a servidores remotos VNC causar una denegación de servicio (caída de la aplicación) o posiblemente ejecutar código arbitrario mediante la especificación de un tamaño de pantalla grande en un mensaje (1) FramebufferUpdate, (2) ResizeFrameBuffer, o (3) PalmVNCReSizeFrameBuffer. A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash. • http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://secunia.com/advisories/61682 http://ubuntu.com/usn/usn-2365-1 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists/oss-security/2014/09/25/11 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.securityfocus. • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 2%CPEs: 6EXPL: 0CVE-2014-6055 – libvncserver: server stacked-based buffer overflow flaws in file transfer handling
https://notcve.org/view.php?id=CVE-2014-6055
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message. Múltiples desbordamientos de buffer basado en pila en la caracteristica File Transfer en rfbserver.c en LibVNCServer 0.9.9 y anteriores permiten a usuarios remotos autenticados causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un (1) fichero largo o (2) nombre de directorio o el (3) atributo FileTime en un mensaje rfbFileTransferOffer. Two stack-based buffer overflow flaws were found in the way LibVNCServer handled file transfers. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client. • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-0113.html http://seclists.org/oss-sec/2014/q3/639 http://secunia.com/advisories/61506 http://www.debian.org/security/2014/dsa-3081 http://www.ocert.org/advisories/ocert-2014-007.html http://www.openwall.com/lists& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •