The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libvncserver | Libvncserver | * | 0.9.9 (including) |
| Red Hat Enterprise Linux 6 | RedHat | libvncserver-0:0.9.7-7.el6_6.1 | * |
| Red Hat Enterprise Linux 7 | RedHat | libvncserver-0:0.9.9-9.el7_0.1 | * |
| Red Hat Enterprise Linux 7 | RedHat | kdenetwork-7:4.10.5-8.el7_0 | * |
| Italc | Ubuntu | trusty | * |
| Italc | Ubuntu | xenial | * |
| Krfb | Ubuntu | trusty | * |
| Libvncserver | Ubuntu | lucid | * |
| Libvncserver | Ubuntu | precise | * |
| Libvncserver | Ubuntu | trusty | * |
| Tightvnc | Ubuntu | bionic | * |
| Tightvnc | Ubuntu | groovy | * |
| Tightvnc | Ubuntu | hirsute | * |
| Tightvnc | Ubuntu | impish | * |
| Tightvnc | Ubuntu | kinetic | * |
| Tightvnc | Ubuntu | lunar | * |
| Tightvnc | Ubuntu | mantic | * |
| Tightvnc | Ubuntu | trusty | * |
| Tightvnc | Ubuntu | trusty/esm | * |
| Tightvnc | Ubuntu | upstream | * |
| Tightvnc | Ubuntu | xenial | * |
| Vino | Ubuntu | bionic | * |
| Vino | Ubuntu | devel | * |
| Vino | Ubuntu | focal | * |
| Vino | Ubuntu | groovy | * |
| Vino | Ubuntu | hirsute | * |
| Vino | Ubuntu | impish | * |
| Vino | Ubuntu | jammy | * |
| Vino | Ubuntu | kinetic | * |
| Vino | Ubuntu | lunar | * |
| Vino | Ubuntu | mantic | * |
| Vino | Ubuntu | noble | * |
| Vino | Ubuntu | oracular | * |
| Vino | Ubuntu | trusty | * |
| Vino | Ubuntu | xenial | * |