CVE-2014-6052

Name	CVE-2014-6052
Description	The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-197-1, DLA-1979-1, DSA-3081-1
Debian Bugs	762745

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libvncserver (PTS)	bullseye	0.9.13+dfsg-2+deb11u1	fixed
	bookworm	0.9.14+dfsg-1	fixed
	sid, trixie	0.9.15+dfsg-1	fixed
veyon (PTS)	bullseye	4.5.3+repack1-1	fixed
	bookworm	4.7.5+repack1-1	fixed
	sid, trixie	4.9.5+repack1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
italc	source	jessie	1:2.0.2+dfsg1-2+deb8u1	DLA-1979-1
italc	source	(unstable)	1:3.0.1+dfsg1-1
libvncserver	source	squeeze	0.9.7-2+deb6u1	DLA-197-1
libvncserver	source	wheezy	0.9.9+dfsg-1+deb7u1	DSA-3081-1
libvncserver	source	(unstable)	0.9.9+dfsg-6.1		762745
veyon	source	(unstable)	4.1.4+repack1-1

https://github.com/newsoft/libvncserver/commit/85a778c0e45e87e35ee7199f1f25020648e8b812