CVE-2014-6052: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2014-6052 is a high (CVSS 7.5) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 6.75% chance of exploitation in the next 30 days, higher than 93.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 15-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.75%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.75% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibvncserver
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian3 products
- libvncserver< 0.9.9+dfsg-6.1
- veyon< 4.1.4+repack1-1
- debian_linuxEOL7.0
Ubuntu2 products
- italc< 1:2.0.2+dfsg1-4ubuntu0.1
- libvncserver< 0.9.9+dfsg-1ubuntu1.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04
Libvncserver1 product
- libvncserver≤ 0.9.9
Oracle1 product
- solarisEOL11.3
5 vendors · 8 products
References
20 links- www.ocert.org/advisories/ocert-2014-007.htmlX Refsource MISCThird Party AdvisoryUS Government ResourceREPORT
- github.com/newsoft/libvncserver/commit/85a778c0e45e87e35ee7199f1f25020648e8b812X Refsource CONFIRMExploitIssue TrackingPatch
Show all 20 references
- www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlX Refsource CONFIRMThird Party Advisory