CVE-2009-0388

Publication date 4 February 2009

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.

Read the notes from the security team

Status

Package Ubuntu Release Status
tightvnc 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy Ignored end of life
6.06 LTS dapper Ignored end of life

Notes

mdeslaur

windows only

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
tightvnc