libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

A flaw was found in libvncserver. An integer overflow within the HandleCursorShape function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted...

libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow

A flaw was found in libvncserver. An integer overflow within the HandleCursorShape function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted...