PT-2020-7085 · Unknown · Libvncserver

Published 2020-02-05 · Updated 2020-02-07 · CVE-2010-5304

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LibVNCServer versions prior to 0.9.9

Description A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText messages. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

Recommendations For versions prior to 0.9.9, update to version 0.9.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the VNC server to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2010-5304

Affected Products

Libvncserver

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2010-5304 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html · Note
• http://openwall.com/lists/oss-security/2014/09/23/6 · Note
• http://seclists.org/oss-sec/2014/q3/639 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140219.html · Note
• https://t.me/cvenotify/806 · Telegram Post
• http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139814.html · Note
• https://t.me/cibsecurity/9635 · Telegram Post