The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kdenetwork-krdc-develUpgrade kdenetwork-kgetUpgrade kdenetwork-develUpgrade kdenetwork-krfbUpgrade kdenetworkUpgrade libvncserver-develUpgrade kdenetwork-fileshare-sambaUpgrade kdenetwork-krdcUpgrade kdenetwork-commonUpgrade kdenetwork-krfb-libsUpgrade kdenetwork-kopeteUpgrade kdenetwork-kopete-develUpgrade libvncserverUpgrade kdenetwork-krdc-libsUpgrade kdenetwork-kopete-libsUpgrade kdenetwork-kget-libsUpgrade kdenetwork-kdnssd | Dec 1, 2016 | Dec 15, 2014 |
| Debian | — | Upgrade tightvncUpgrade vinoUpgrade libvncserver | Jul 30, 2024 | Dec 15, 2014 |
| Freebsd | — | Upgrade libvncserver | Dec 10, 2025 | Oct 11, 2016 |
| Gentoo Linux | — | Upgrade net-libs/libvncserver. | Oct 30, 2017 | Dec 15, 2014 |
| Oracle_linux | — | Upgrade kdenetwork-commonUpgrade kdenetwork-krfbUpgrade kdenetworkUpgrade kdenetwork-kopete-libsUpgrade kdenetwork-develUpgrade kdenetwork-krdc-libsUpgrade kdenetwork-kget-libsUpgrade kdenetwork-kopete-develUpgrade kdenetwork-kopeteUpgrade kdenetwork-kgetUpgrade libvncserver-develUpgrade kdenetwork-kdnssdUpgrade libvncserverUpgrade kdenetwork-krdc-develUpgrade kdenetwork-fileshare-sambaUpgrade kdenetwork-krdcUpgrade kdenetwork-krfb-libs | Oct 16, 2024 | Dec 15, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2014 |
| Suse | — | Upgrade LibVNCServer-develUpgrade LibVNCServerUpgrade libvncserver0Upgrade libvncclient0 | Dec 18, 2015 | Dec 15, 2014 |
| Ubuntu | — | Upgrade libvncserver0Upgrade vinoUpgrade italc-masterUpgrade libitalccoreUpgrade italc-client | Mar 22, 2023 | Dec 15, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub