CVE-2014-6055

MEDIUM 6.5CVE-2014-6055 · Published 30/09/2014 · updated 17/06/2026

In short

CVE-2014-6055 is a MEDIUM (CVSS 6.5) vulnerability affecting libvncserver (libvncserver).
Chance of exploitation in the next 30 days (EPSS): 7.8%, higher than 94.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libvncserver libvncserver	`≤ 0.9.9`	No fix yet

Description

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

References

lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00022.html
rhn.redhat.com/errata/RHSA-2015-0113.html · Third Party Advisory
seclists.org/oss-sec/2014/q3/639 · Mailing List
secunia.com/advisories/61506
debian.org/security/2014/dsa-3081 · Third Party Advisory
ocert.org/advisories/ocert-2014-007.html · Third Party Advisory
openwall.com/lists/oss-security/2014/09/25/11 · Mailing List
securityfocus.com/bid/70096 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/96187
newsoft/libvncserver commit 06ccdf0

More vulnerabilities in libvncserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free