CVE-2014-6053

Published: 24 September 2014

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.

Priority

Status

Package	Release	Status
libvncserver Launchpad, Ubuntu, Debian	impish	Not vulnerable
	bionic	Not vulnerable
	upstream	Needs triage
	lucid	Ignored (end of life)
	hirsute	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	precise	Released (0.9.8.2-2ubuntu1.1)
	trusty	Released (0.9.9+dfsg-1ubuntu1.1)
	lunar	Not vulnerable
	focal	Not vulnerable
	groovy	Not vulnerable
	xenial	Not vulnerable
	Patches: upstream: https://github.com/LibVNC/libvncserver/commit/6037a9074d52b1963c97cb28ea1096c7c14cbf28
vino Launchpad, Ubuntu, Debian	impish	Released (3.22.0-6ubuntu1)
	trusty	Does not exist
	hirsute	Released (3.22.0-6ubuntu1)
	jammy	Released (3.22.0-6ubuntu1)
	kinetic	Released (3.22.0-6ubuntu1)
	lunar	Released (3.22.0-6ubuntu1)
	bionic	Released (3.22.0-3ubuntu1.1)
	focal	Released (3.22.0-5ubuntu2.1)
	groovy	Released (3.22.0-6ubuntu1)
	upstream	Needs triage
	xenial	Released (3.8.1-0ubuntu9.3)
krfb Launchpad, Ubuntu, Debian	impish	Not vulnerable
	focal	Not vulnerable
	groovy	Not vulnerable
	xenial	Not vulnerable
	bionic	Not vulnerable
	upstream	Needs triage
	lucid	Does not exist
	precise	Does not exist
	hirsute	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	trusty	Released (4:4.13.3-0ubuntu1.1)
	lunar	Not vulnerable
	Patches: upstream: http://quickgit.kde.org/?p=krfb.git&a=commit&h=d931eafccf3140d740ac61e876dce72a23ade7f4
italc Launchpad, Ubuntu, Debian	impish	Does not exist
	upstream	Needs triage
	trusty	Does not exist (trusty was needs-triage)
	xenial	Released (1:2.0.2+dfsg1-4ubuntu0.1)
	bionic	Not vulnerable (code not present)
	focal	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
tightvnc Launchpad, Ubuntu, Debian	hirsute	Ignored (end of life)
	kinetic	Ignored (end of life, was needs-triage)
	jammy	Needs triage
	impish	Ignored (end of life)
	trusty	Released (1.3.9-6.5+deb8u1build0.14.04.1~esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	lunar	Needs triage
	bionic	Needs triage
	focal	Needs triage
	groovy	Ignored (end of life)
	upstream	Released (1:1.3.9-6.5+deb8u1)
	xenial	Needs triage

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›