Vulnerability in libvncserver - Heap-based Buffer Overflow
Summary
DLA-777-1: libvncserver - security update. Affects libvncserver versions < 0.9.9+dfsg-1+deb7u2. Fixed in 0.9.9+dfsg-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvncserver is a library used to create and embed a VNC (Virtual Network Computing) server. VNC is a remote desktop protocol that allows users to control and interact with remote desktop environments. libvncserver provides the necessary functionality to implement VNC servers in various applications. However, a vulnerability has been discovered in libvncserver that could be exploited by remote servers to cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2016-9941, is a heap-based buffer overflow in libvncserver. It occurs when a remote server sends a crafted FramebufferUpdate message containing a subrectangle outside of the drawing area. This can lead to a denial of service condition. Another vulnerability, CVE-2016-9942, is also present in libvncserver. This vulnerability is a heap-based buffer overflow that occurs when a remote server sends a FramebufferUpdate message with the Ultra type tile, causing the LZO decompressed payload to exceed the size of the tile dimensions. This can also result in a denial of service.
How To Fix
Minimum fixed version
0.9.9+dfsg-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvncserverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in libvncserver can be fixed by upgrading to the latest version of the package. It is important to keep software up to date to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libvncserver →
FAQ
libvncserver is a library used to create and embed VNC servers in applications.
A heap-based buffer overflow is a type of vulnerability where a program writes more data into a buffer in the heap memory than it can hold, leading to memory corruption and potential exploitation.
CVE-2016-9941 is the identifier for the heap-based buffer overflow vulnerability in libvncserver that allows remote servers to cause a denial of service.
CVE-2016-9942 is the identifier for the heap-based buffer overflow vulnerability in libvncserver that allows remote servers to cause a denial of service by exceeding the size of the tile dimensions.
To fix the vulnerability, you should upgrade the libvncserver package to version 0.9.9+dfsg-1+deb7u2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for libvncserver.
