CVE-2014-6053
tightvnc - security update
EPSS 7.6%
描述
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.
如何修補 CVE-2014-6053
要修補 CVE-2014-6053,請將受影響套件升級到下列已修補版本。
- Debian/libvncserver—升級至 0.9.9+dfsg-6.1 或更新版本
- Debian/tightvnc—升級至 1:1.3.9-9.1 或更新版本
- —升級至 1.3.9-6.5+deb8u1 或更新版本
- —升級至 3.22.0-6 或更新版本
- —升級至 3.14.0-2+deb8u1 或更新版本
CVE-2014-6053 正在被利用嗎?
中等 — EPSS 為 7.6%,可持續追蹤但非最高優先。
受影響套件(5)
- from 0, < 0.9.9+dfsg-6.1
- from 0, < 1:1.3.9-9.1
- from 0, < 1.3.9-6.5+deb8u1
- from 0, < 3.22.0-6
- from 0, < 3.14.0-2+deb8u1