CVE-2014-6051

ÉLEVÉE 7.5CVE-2014-6051 · Published 30/09/2014 · updated 17/06/2026

En bref

CVE-2014-6051 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant libvncserver (libvncserver).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 8.3%, plus élevée que 94.9% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
libvncserver libvncserver	`≤ 0.9.9`	No fix yet

Description

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

References

lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2015-12/msg00022.html
rhn.redhat.com/errata/RHSA-2015-0113.html · Third Party Advisory
seclists.org/oss-sec/2014/q3/639 · Third Party Advisory
secunia.com/advisories/61506 · Permissions Required
debian.org/security/2014/dsa-3081 · Third Party Advisory
ocert.org/advisories/ocert-2014-007.html · Patch
openwall.com/lists/oss-security/2014/09/25/11 · Third Party Advisory
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · Third Party Advisory
securityfocus.com/bid/70093
newsoft/libvncserver commit 045a044 · Patch
lists.debian.org/debian-lts-announce/2019/10/msg00042.html
security.gentoo.org/glsa/201507-07
security.gentoo.org/glsa/201612-36
usn.ubuntu.com/4587-1
kde.org/info/security/advisory-20140923-1.txt · Third Party Advisory

Autres vulnérabilités de libvncserver

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free