7.5

CVE-2014-6052

Exploit
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libvncserver ≫ Libvncserver Version <= 0.9.9
Oracle ≫ Solaris Version 11.3
Debian ≫ Debian Linux Version 7.0
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.76% 0.931
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html
http://seclists.org/oss-sec/2014/q3/639
Third Party Advisory
Mailing List
http://secunia.com/advisories/61506
Third Party Advisory
Permissions Required
http://www.debian.org/security/2014/dsa-3081
Third Party Advisory
http://www.ocert.org/advisories/ocert-2014-007.html
Third Party Advisory
US Government Resource
http://www.openwall.com/lists/oss-security/2014/09/25/11
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
https://security.gentoo.org/glsa/201507-07
https://usn.ubuntu.com/4587-1/
http://secunia.com/advisories/61682
Third Party Advisory
Permissions Required
http://ubuntu.com/usn/usn-2365-1
Third Party Advisory
http://www.securityfocus.com/bid/70091
https://github.com/newsoft/libvncserver/commit/85a778c0e45e87e35ee7199f1f25020648e8b812
Patch
Exploit
Issue Tracking