CVE-2016-9942

CWE-119 — Buffer OverflowCWE-122 — Heap-based Buffer Overflow14 documents8 sources
Severity
9.8CRITICAL
EPSS
0.8%
top 25.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Libvncserver Project Libvncserver
Timeline
PublishedDec 31
Latest updateMay 13

Description

Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶Debianlibvncserver< 0.9.11+dfsg-1+3
▶Ubuntulibvncserver< 0.9.9+dfsg-1ubuntu1.2+1
▶Debianveyon< 4.1.4+repack1-1+3

🔴Vulnerability Details

5
GHSA
GHSA-wx7p-737c-9wqw: Heap-based buffer overflow in ultra↗2022-05-13
▶
OSV
italc vulnerabilities↗2020-10-20
▶
OSV
libvncserver vulnerabilities↗2017-01-11
▶
CVEList
CVE-2016-9942: Heap-based buffer overflow in ultra↗2016-12-31
▶
OSV
CVE-2016-9942: Heap-based buffer overflow in ultra↗2016-12-31
▶

📋Vendor Advisories

4
Ubuntu
iTALC vulnerabilities↗2020-10-20
▶
Ubuntu
LibVNCServer vulnerabilities↗2017-01-11
▶
Red Hat
libvncserver: Heap-based buffer overflow in ultra.c↗2016-11-14
▶
Debian
CVE-2016-9942: libvncserver - Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9...↗2016
▶

💬Community

4
Bugzilla
CVE-2016-9942 libvncserver: Heap-based buffer overflow in ultra.c↗2017-01-04
▶
Bugzilla
CVE-2016-9941 CVE-2016-9942 libvncserver: various flaws↗2017-01-04
▶
Bugzilla
CVE-2016-9941 CVE-2016-9942 libvncserver: various flaws [fedora-all]↗2017-01-04
▶
Bugzilla
CVE-2016-9941 CVE-2016-9942 libvncserver: various flaws [epel-5]↗2017-01-04
▶