CVE-2014-6052 — Improper Input Validation in Libvncserver

CWE-20 — Improper Input ValidationCWE-476 — NULL Pointer Dereference22 documents8 sources
Severity
9.8CRITICALNVD
NVD7.5CNA7.5OSV7.5
EPSS
5.2%
top 10.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Libvncserver Project LibvncserverTigervncLibvncserver+7 more
Timeline
PublishedDec 15
Latest updateMay 17

Description

The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages9 packages

▶Debianlibvncserver_project/libvncserver< 0.9.9+dfsg-6.1+3
▶Ubuntulibvncserver_project/libvncserver< 0.9.9+dfsg-1ubuntu1.1
▶Debiantigervnc/tigervnc< 1.7.0-2+3
▶NVDoracle/solaris11.3

Also affects: Debian Linux 7.0, Ubuntu Linux 12.04, 14.04

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

8
GHSA
GHSA-gq2g-qwmw-m5q3: XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return v↗2022-05-17
▶
GHSA
GHSA-hph4-vx7v-q23g: The HandleRFBServerMessage function in libvncclient/rfbproto↗2022-05-13
▶
OSV
italc vulnerabilities↗2020-10-20
▶
OSV
CVE-2014-8241: XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return v↗2016-12-14
▶
CVEList
CVE-2014-8241: XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return v↗2016-12-14
▶

📋Vendor Advisories

6
Ubuntu
iTALC vulnerabilities↗2020-10-20
▶
Red Hat
tigervnc: NULL pointer dereference flaw in XRegion↗2014-10-10
▶
Ubuntu
LibVNCServer vulnerabilities↗2014-09-29
▶
Red Hat
libvncserver: NULL pointer dereference flaw in framebuffer setup↗2014-09-23
▶
Debian
CVE-2014-8241: tigervnc - XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL...↗2014
▶

💬Community

6
Bugzilla
CVE-2014-8241 tigervnc: NULL pointer dereference flaw in XRegion↗2014-10-10
▶
Bugzilla
CVE-2014-6051 CVE-2014-6053 CVE-2014-6052 CVE-2014-6055 CVE-2014-6054 krfb: various flaws [fedora-all]↗2014-09-24
▶
Bugzilla
CVE-2014-6051 CVE-2014-6053 CVE-2014-6052 CVE-2014-6055 CVE-2014-6054 libvncserver: various flaws [fedora-all]↗2014-09-24
▶
Bugzilla
CVE-2014-6051 CVE-2014-6053 CVE-2014-6052 CVE-2014-6055 CVE-2014-6054 libvncserver: various flaws [epel-5]↗2014-09-24
▶
Bugzilla
CVE-2014-6051 CVE-2014-6053 CVE-2014-6052 CVE-2014-6055 libvncserver: various flaws [epel-7]↗2014-09-24
▶
CVE-2014-6052 — Improper Input Validation | cvebase