{"id":"CVE-2014-6051","aliases":["DEBIAN-CVE-2014-6051","DLA-197-1","DLA-1979-1","DSA-3081-1","EUVD-2014-5939","GHSA-6457-9pfw-39g2","MGASA-2014-0397","RHSA-2014:1826","RHSA-2015:0113","SUSE-SU-2015:2088-1","SUSE-SU-2015:2088-2","SUSE-SU-2015:2110-1","UBUNTU-CVE-2014-6051","USN-2365-1","USN-4587-1"],"status":"published","title":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and...","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08272,"percentile":0.94951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2014-09-24T00:00:00Z","modified":"2026-10-23T15:47:26Z","fixes":[{"ecosystem":"Debian:12","package":"libvncserver","fixed_in":["0.9.9+dfsg-6.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvncserver","fixed_in":["0.9.9+dfsg-6.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvncserver","fixed_in":["0.9.9+dfsg-6.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"veyon","fixed_in":["4.1.4+repack1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"veyon","fixed_in":["4.1.4+repack1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","fixed_in":["0.9.9+dfsg-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"italc","fixed_in":["1:2.0.2+dfsg1-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-6.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-6.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4+repack1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"veyon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4+repack1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-2+deb6u1"}]}],"versions":["0.9.7-2"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2+dfsg1-2+deb8u1"}]}],"versions":["1:2.0.2+dfsg1-2"],"bundled":21},{"source":"osv","ecosystem":"Debian:7","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-1+deb7u1"}]}],"versions":["0.9.9+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-2.2.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"remmina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.2.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-3.2.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"remmina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-4.4.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-9.el7_0.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.7-7.el6_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-156.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-1ubuntu1.1"}]}],"versions":["0.9.9+dfsg-1","0.9.9+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2+dfsg1-4ubuntu0.1"}]}],"versions":["1:2.0.2+dfsg1-3","1:2.0.2+dfsg1-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg-1ubuntu1.1"}]}],"versions":["0.9.9+dfsg-1","0.9.9+dfsg-1ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"italc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2+dfsg1-4ubuntu0.1"}]}],"versions":["1:2.0.2+dfsg1-3","1:2.0.2+dfsg1-4"],"bundled":19}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libvncserver","product":"libvncserver"},{"vendor":"oracle","product":"solaris"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"}],"references":[{"url":"http://www.ocert.org/advisories/ocert-2014-007.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","US Government Resource","advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/201612-36","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/newsoft/libvncserver/commit/045a044e8ae79db9244593fbce154cdf6e843273","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/61506","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Permissions Required","Third Party Advisory","advisory","report"]},{"url":"https://www.kde.org/info/security/advisory-20140923-1.txt","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0113.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/09/25/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/oss-sec/2014/q3/639","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/201507-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/70093","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3081","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4587-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6051","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4587-1"},{"url":"https://github.com/advisories/GHSA-6457-9pfw-39g2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-6051","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0397.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14155","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1826","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144293","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1826.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6051","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6052","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6053","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6054","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-6055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6055","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0113","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0113.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152088-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/854151","tags":["report"]},{"url":"https://bugzilla.suse.com/897031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6055","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152088-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152110-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-6051","tags":["report"]},{"url":"http://www.kde.org/info/security/advisory-20140923-1.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2365-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4587-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-6052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-6055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-15127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15681","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-6051","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-30T16:00:00Z","modified":"2024-08-06T12:03:02.339Z","updated_at":"2026-11-02T14:33:45.263043Z"}],"euvd":[{"id":"EUVD-2014-5939","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-30T16:00:00Z","modified":"2024-08-06T12:03:02Z","updated_at":"2026-11-03T01:57:00.425792Z"}],"ghsa":[{"id":"GHSA-6457-9pfw-39g2","title":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and...","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-13T01:14:20Z","modified":"2025-04-12T12:40:06Z","updated_at":"2026-11-02T15:01:18.899916Z"}],"nvd":[{"id":"CVE-2014-6051","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-30T16:55:07.01Z","modified":"2026-06-17T00:12:30.873Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:56.266125Z"}],"osv":[{"id":"CVE-2014-6051","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-30T16:55:07Z","modified":"2026-04-16T06:16:38.580253877Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-6051","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-30T16:55:07.01Z","modified":"2026-10-23T15:47:26.082313814Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-197-1","title":"libvncserver - security update","status":"published","published":"2015-04-14T00:00:00Z","modified":"2026-03-09T01:23:10.156501Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-1979-1","title":"italc - security update","status":"published","published":"2019-10-30T00:00:00Z","modified":"2026-03-09T01:18:20.937176Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3081-1","title":"libvncserver - security update","status":"published","published":"2014-11-29T00:00:00Z","modified":"2026-03-09T01:20:34.019376Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0397","title":"Updated libvncserver \u0026 remmina packages fix security vulnerabilities","description":"Updated libvncserver and remmina packages fix security vulnerabilities:\n\nA malicious VNC server can trigger incorrect memory management handling by\nadvertising a large screen size parameter to the VNC client. This would result\nin multiple memory corruptions and could allow remote code execution on the\nVNC client (CVE-2014-6051, CVE-2014-6052).\n\nA malicious VNC client can trigger multiple DoS conditions on the VNC server\nby advertising a large screen size, ClientCutText message length and/or a zero\nscaling factor parameter (CVE-2014-6053, CVE-2014-6054).\n\nA malicious VNC client can trigger multiple stack-based buffer overflows by\npassing a long file and directory names and/or attributes (FileTime) when\nusing the file transfer message feature (CVE-2014-6055).\n\nThe remmina package had been built with a bundled copy of libvncserver.  It\nhas been rebuilt against the system libvncserver library to resolve these\nissues.\n","status":"published","published":"2014-10-07T09:22:51Z","modified":"2026-04-16T06:26:11.864650272Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:1826","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-15T22:09:13Z","modified":"2026-06-28T10:12:07Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0113","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-15T22:09:02Z","modified":"2026-06-28T10:12:55Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:2088-1","title":"Security update for LibVNCServer","description":"The LibVNCServer package was updated to fix the following security issues:\n\n- bsc#897031: fix several security issues:\n  * CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.\n  * CVE-2014-6052: Lack of malloc() return value checking on client side.\n  * CVE-2014-6053: Server crash on a very large ClientCutText message.\n  * CVE-2014-6054: Server crash when scaling factor is set to zero.\n  * CVE-2014-6055: Multiple stack overflows in File Transfer feature.\n- bsc#854151: Restrict the SSL cipher suite.\n","status":"published","published":"2015-12-30T13:04:03Z","modified":"2026-02-04T04:20:39.038219Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2088-2","title":"Security update for LibVNCServer","description":"The LibVNCServer package was updated to fix the following security issues:\n\n- bsc#897031: fix several security issues:\n  * CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.\n  * CVE-2014-6052: Lack of malloc() return value checking on client side.\n  * CVE-2014-6053: Server crash on a very large ClientCutText message.\n  * CVE-2014-6054: Server crash when scaling factor is set to zero.\n  * CVE-2014-6055: Multiple stack overflows in File Transfer feature.\n- bsc#854151: Restrict the SSL cipher suite.\n","status":"published","published":"2015-12-30T13:04:00Z","modified":"2026-02-04T03:45:09.633482Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:2110-1","title":"Security update for LibVNCServer","description":"The libvncserver package was updated to fix the following security issues:\n\n- bsc#897031: fix several security issues:\n  * CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side.\n  * CVE-2014-6052: Lack of malloc() return value checking on client side.\n  * CVE-2014-6053: Server crash on a very large ClientCutText message.\n  * CVE-2014-6054: Server crash when scaling factor is set to zero.\n  * CVE-2014-6055: Multiple stack overflows in File Transfer feature.\n","status":"published","published":"2015-11-26T10:47:31Z","modified":"2026-02-04T02:41:35.195704Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2014-6051","description":"Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-04-22T09:47:15.43485Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2365-1","title":"libvncserver vulnerabilities","description":"Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when\nbeing advertised large screen sizes by the server. If a user were tricked\ninto connecting to a malicious server, an attacker could use this issue to\ncause a denial of service, or possibly execute arbitrary code.\n(CVE-2014-6051, CVE-2014-6052)\n\nNicolas Ruff discovered that LibVNCServer incorrectly handled large\nClientCutText messages. A remote attacker could use this issue to cause a\nserver to crash, resulting in a denial of service. (CVE-2014-6053)\n\nNicolas Ruff discovered that LibVNCServer incorrectly handled zero scaling\nfactor values. A remote attacker could use this issue to cause a server to\ncrash, resulting in a denial of service. (CVE-2014-6054)\n\nNicolas Ruff discovered that LibVNCServer incorrectly handled memory in the\nfile transfer feature. A remote attacker could use this issue to cause a\nserver to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2014-6055)\n","status":"published","published":"2014-09-29T17:12:11Z","modified":"2026-04-27T15:17:30.842817532Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-4587-1","title":"italc vulnerabilities","description":"Nicolas Ruff discovered that iTALC had buffer overflows, divide-by-zero errors\nand didn't check malloc return values. A remote attacker could use these issues\nto cause a denial of service or possibly execute arbitrary code.\n(CVE-2014-6051, CVE-2014-6052, CVE-2014-6053, CVE-2014-6054, CVE-2014-6055)\n\nJosef Gajdusek discovered that iTALC had heap-based buffer overflow\nvulnerabilities. A remote attacker could used these issues to cause a denial of\nservice or possibly execute arbitrary code. (CVE-2016-9941, CVE-2016-9942)\n\nIt was discovered that iTALC had an out-of-bounds write, multiple heap\nout-of-bounds writes, an infinite loop, improper initializations, and null\npointer vulnerabilities. A remote attacker could used these issues to cause a\ndenial of service or possibly execute arbitrary code. (CVE-2018-15127,\nCVE-2018-20019, CVE-2018-20020, CVE-2018-20021, CVE-2018-20022, CVE-2018-20023,\nCVE-2018-20024, CVE-2018-20748, CVE-2018-20749, CVE-2018-20750, CVE-2018-7225,\nCVE-2019-15681)\n","status":"published","published":"2020-10-20T16:35:20Z","modified":"2026-04-27T15:48:42.890842055Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}