CVE-2020-29260

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

libvncserver is a set of programs using the RFB (Remote Frame Buffer) protocol. They are designed to "export" a frame buffer via net: you set up a server and can connect to it via VNC viewers. If the server supports WebSockets (which LibVNCServer does), you can also connect using an in-browser VNC viewer like noVNC. It is already in wide use for administration, but it is not that easy to program a server yourself.

Security Fix(es):

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().(CVE-2020-29260)

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup(). (CVE-2020-29260)

These are all security issues fixed in the LibVNCServer-devel-0.9.13-4.1 package on the GA media of openSUSE Tumbleweed.

This update for LibVNCServer fixes the following issues:

• CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).

This update for LibVNCServer fixes the following issues:

• CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).

This update for LibVNCServer fixes the following issues:

• CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106).

It was discovered that LibVNCServer had a memory leak in the client cleanup function. An attacker could possibly use this issue to cause LibVNCServer to consume memory, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2020-29260)

It was discovered that LibVNCServer did not properly validate bounds when handling UltraZip encoding subrectangles. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2026-32853)

It was discovered that LibVNCServer did not properly validate return values in the HTTP proxy handlers. A remote attacker could possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2026-32854)

It was discovered that LibVNCServer did not properly handle Tight encoding gradient filter rectangles. A remote attacker could use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-44988)