2435 matches found
[SECURITY] [DLA 4755-1] libvncserver security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4755-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 25, 2026 https://wiki.debian.org/LTS -...
SUSE CVE-2026-50538
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
Debian dla-4755 : libvncclient1 - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4755 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4755-1 [email protected]...
CVE-2026-78417
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...
EUVD-2026-65063
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...
BIT-AUTHENTIK-2026-61574 authentik RAC: access any endpoint via an unrelated application
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...
PT-2026-80992
Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions prior to 2026.2.17.1 Devolutions Remote Desktop Manager versions prior to 2026.1.24.1 Description Insufficient verification of data authenticity in the IronVNC client allows an on-path attacker to...
CVE-2026-50538
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
CVE-2026-50538
LibVNCClient (part of the LibVNCServer project) versions 0.9.12 through 0.9.15 contain an out-of-bounds heap write in the Tight decoder . A malicious or man-in-the-middle VNC server can trigger this by sending a single crafted FramebufferUpdate message, writing attacker-controlled data past the e...
CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
EUVD-2026-64167
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
CVE-2026-50538 libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
CVE-2026-50538: Heap-based Buffer Overflow
LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with...
gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...
gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer
A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...
CVE-2026-61574 authentik RAC: access any endpoint via an unrelated application
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...
CVE-2026-61574 authentik RAC: access any endpoint via an unrelated application
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...
Amazon Linux 2 : qemu, --advisory ALAS2-2026-3866 (ALAS-2026-3866)
The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3866 advisory. In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, an...
gstreamer1-plugins-bad-free security update
1.26.7-2.7 - Fix ADPCM decoder input validation CVE-2026-19387 Resolves: RHEL-235500 1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550 1.26.7-2.4 - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves...
Important: qemu
Issue Overview: In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, and bluemax fields from a client's SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8t. A malicious VNC...