| Package | Affected versions | Patched versions |
|---|---|---|
| vino | = 2.10= 2.11= 2.12= 2.13= 2.13.5= 2.14= 2.15= 2.16= 2.17= 2.17.2= 2.17.4= 2.17.5= 2.17.92= 2.18= 2.18.1= 2.19= 2.19.5= 2.19.90= 2.19.92= 2.20= 2.20.1= 2.21= 2.21.1= 2.21.2= 2.21.3= 2.21.90= 2.21.91= 2.21.92= 2.22= 2.22.1= 2.22.2= 2.23= 2.23.5= 2.23.90= 2.23.91= 2.23.92= 2.24= 2.24.1= 2.25= 2.25.3= 2.25.4= 2.25.5= 2.25.90= 2.25.91= 2.25.92= 2.26= 2.26.1= 2.26.2= 2.27= 2.27.5= 2.27.90= 2.27.91= 2.27.92= 2.28= 2.28.1= 2.28.2= 2.32.0= 2.32.1= 2.7= 2.7.3= 2.7.3.1= 2.7.4= 2.7.4.90= 2.7.4.91= 2.7.92= 2.8= 2.9= 2.9.2= 3.0.0= 3.0.1= 3.1 |
The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free