The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kdenetwork-kopeteUpgrade kdenetwork-kopete-develUpgrade kdenetwork-krdc-libsUpgrade kdenetwork-kget-libsUpgrade libvncserverUpgrade kdenetwork-kdnssdUpgrade kdenetwork-krfb-libsUpgrade kdenetwork-kopete-libsUpgrade kdenetwork-develUpgrade kdenetwork-kgetUpgrade libvncserver-develUpgrade kdenetworkUpgrade kdenetwork-commonUpgrade kdenetwork-krdc-develUpgrade kdenetwork-krfbUpgrade kdenetwork-krdcUpgrade kdenetwork-fileshare-samba | Dec 1, 2016 | Dec 15, 2014 |
| Debian | — | Upgrade libvncserverUpgrade tightvncUpgrade vino | Jul 30, 2024 | Dec 15, 2014 |
| Freebsd | — | Upgrade libvncserver | Dec 10, 2025 | Oct 11, 2016 |
| Gentoo Linux | — | Upgrade net-libs/libvncserver. | Oct 30, 2017 | Dec 15, 2014 |
| Oracle_linux | — | Upgrade kdenetwork-kgetUpgrade kdenetwork-krdcUpgrade kdenetwork-fileshare-sambaUpgrade kdenetwork-kopete-develUpgrade kdenetwork-krfb-libsUpgrade libvncserverUpgrade kdenetwork-krdc-develUpgrade kdenetwork-kdnssdUpgrade kdenetwork-kopeteUpgrade libvncserver-develUpgrade kdenetworkUpgrade kdenetwork-kopete-libsUpgrade kdenetwork-krfbUpgrade kdenetwork-develUpgrade kdenetwork-commonUpgrade kdenetwork-krdc-libsUpgrade kdenetwork-kget-libs | Oct 16, 2024 | Dec 15, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2014 |
| Suse | — | Upgrade libvncclient0Upgrade LibVNCServer-develUpgrade LibVNCServerUpgrade libvncserver0 | Dec 18, 2015 | Dec 15, 2014 |
| Ubuntu | — | Upgrade vinoUpgrade italc-masterUpgrade libitalccoreUpgrade italc-clientUpgrade libvncserver0 | Mar 22, 2023 | Dec 15, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub