105 matches found
Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3833 (ALAS-2026-3833)
The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3833 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264...
RLSA-2026:47179 Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer...
GStreamer librfb: rfb_decoder_fill_rectangle() wrong write granularity causes heap out-of-bounds write
GStreamer librfb: rfbdecoderfillrectangle wrong write granularity causes heap out-of-bounds write Vulnerability Overview In rfbsrc the VNC/RFB client element of GStreamer gst-plugins-bad, rfbdecoderfillrectangle fills rectangles by writing pixels at guint32 4-byte granularity regardless of the...
CVE-2026-41252
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices ar...
CVE-2026-41252: Heap-based Buffer Overflow
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices ar...
Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1917)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1917 advisory. A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a...
gstreamer1-plugins-bad-free security update
1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves: RHEL-184391 1.26.7-2.3 - Fix for CVE-2026-52719 Resolves: RHEL-184406 1.26.7-2.2 - Fix integer overflows in VMnc decoder CVE-2026-52722 Resolves: RHEL-184425 1.26.7-2.1 - Fix for CVE-2026-52720: validate...
Important: gstreamer1-plugins-bad-free
Issue Overview: A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a bit count, causing parser desynchronization. A remote attacker could trick a user into...
CVE-2026-7838 UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field type CARD32 is passed as reasonLen+1 to CheckBufferSize. Because both...
CVE-2026-44041: Out-of-bounds Read
UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb function passes a caller-supplied WCHAR pointer to wcslen before any bounds check. If the caller provides a wide-character buffer that is not properly...
CVE-2026-7831: Off-by-one Error
UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer dn2024 and calls ReadStringdn, 2024. ReadString...
CVE-2026-7838: Integer Overflow or Wraparound
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field type CARD32 is passed as reasonLen+1 to CheckBufferSize. Because both...
EUVD-2026-36803
A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...
CVE-2026-52720
A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...
MiracleLinux 3 : vnc-4.1.2-9.6AXS3 (AXSA:2009-21:01)
The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2009-21:01 advisory. Virtual Network Computing VNC is a remote display system which allows you to view a computing 'desktop' environment not only on the machine where it is running...
EUVD-2008-4750
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2019-15678
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be...
rfb.org.mx Improper Access Control vulnerability OBB-3858963
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
SUSE CVE-2018-7225
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact e.g., an integer overflow via specially crafted VNC packets...