HIGH
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
http://www.openwall.com/lists/oss-security/2018/02/18/1
http://www.securityfocus.com/bid/103107
https://access.redhat.com/errata/RHSA-2018:1055
https://github.com/LibVNC/libvncserver/issues/218
https://lists.debian.org/debian-lts-announce/2018/03/msg00035.html
https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html
https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
https://security.gentoo.org/glsa/201908-05
https://usn.ubuntu.com/3618-1/
https://usn.ubuntu.com/4547-1/
https://usn.ubuntu.com/4573-1/
Source: MITRE
Published: 2018-02-19
Updated: 2020-10-23
Type: CWE-190
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL