USN-2365-1

See a problem?
Source
https://ubuntu.com/security/notices/USN-2365-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-2365-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-2365-1
Related
  • CVE-2014-6051
  • CVE-2014-6052
  • CVE-2014-6053
  • CVE-2014-6054
  • CVE-2014-6055
Published
2014-09-29T17:12:11.868917Z
Modified
2014-09-29T17:12:11.868917Z
Summary
libvncserver vulnerabilities
Details

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory when being advertised large screen sizes by the server. If a user were tricked into connecting to a malicious server, an attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2014-6051, CVE-2014-6052)

Nicolas Ruff discovered that LibVNCServer incorrectly handled large ClientCutText messages. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6053)

Nicolas Ruff discovered that LibVNCServer incorrectly handled zero scaling factor values. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service. (CVE-2014-6054)

Nicolas Ruff discovered that LibVNCServer incorrectly handled memory in the file transfer feature. A remote attacker could use this issue to cause a server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-6055)

References

Affected packages

Ubuntu:14.04:LTS / libvncserver

Package

Name
libvncserver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.9+dfsg-1ubuntu1.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "libvncserver-dev": "0.9.9+dfsg-1ubuntu1.1",
            "linuxvnc": "0.9.9+dfsg-1ubuntu1.1",
            "libvncserver-config": "0.9.9+dfsg-1ubuntu1.1",
            "libvncserver0": "0.9.9+dfsg-1ubuntu1.1"
        }
    ]
}