Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling libvncserver: NULL pointer dereference flaw in framebuffer setup libvncserver: server NULL pointer dereference flaw in ClientCutText message handling libvncserver: server divide-by-zero flaw in scaling factor handling libvncserver: server stacked-based buffer overflow flaws in file transfer handling

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Security update for LibVNCServer

Affected: Ubuntu:14.04:LTS: krfb, Ubuntu:14.04:LTS: libvncserver, Ubuntu:16.04:LTS: italc

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.