CVE-2016-9941: Buffer Overflow
Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1Fixed in 0.9.15+dfsg-1 - Upgrade
Upgrade
debian/veyonto a version that resolves this vulnerability.Fixed in 4.5.3+repack1-1Fixed in 4.7.5+repack1-1Fixed in 4.7.5+repack1-1.2Fixed in 4.9.5+repack1-2 - Upgrade
Upgrade
alpine/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.11-r0 - Upgrade
Upgrade
alpine/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.10-r2 - Upgrade
Upgrade
LibVNCServer/LibVNCClientto a version that resolves this vulnerability.Fixed in 0.9.11
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-9941.
What is the severity level of CVE-2016-9941?
CVE-2016-9941 has a severity level of critical.
Which software versions are affected by CVE-2016-9941?
CVE-2016-9941 affects LibVNCServer versions before 0.9.11.
How does CVE-2016-9941 impact the affected software?
CVE-2016-9941 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code through a crafted FramebufferUpdate message.
Are there any available fixes or patches for CVE-2016-9941?
Yes, updates are available for LibVNCServer to address CVE-2016-9941. Users should update to version 0.9.11 or later.