In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbproto.c (for the vncviewer component). There is no check on the size given to malloc, e.g., -1 is accepted. This allocates a chunk of size zero, which will give a heap pointer. However, one can send 0xffffffff bytes of data, which can have a DoS impact or lead to remote code execution.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | tightvnc | < 1:1.3.10-6 | tightvnc_1:1.3.10-6_all.deb |
Debian | 11 | all | tightvnc | < 1:1.3.10-3 | tightvnc_1:1.3.10-3_all.deb |
Debian | 10 | all | tightvnc | < 1:1.3.9-9+deb10u1 | tightvnc_1:1.3.9-9+deb10u1_all.deb |
Debian | 999 | all | tightvnc | < 1:1.3.10-6 | tightvnc_1:1.3.10-6_all.deb |