Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling libvncserver: NULL pointer dereference flaw in framebuffer setup libvncserver: server NULL pointer dereference flaw in ClientCutText message handling libvncserver: server divide-by-zero flaw in scaling factor handling libvncserver: server stacked-based buffer overflow flaws in file transfer handling

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Security update for LibVNCServer

Affected: Ubuntu:14.04:LTS: libvncserver, Ubuntu:16.04:LTS: italc

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.