Unscored severity · published Oct 16, 2014
CVE-2014-8240
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
Tigervnc · Tigervnc
0.0.90; 0.0.91; 1.0.0; 1.0.1; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8240
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8240
seclists.org
http://seclists.org/oss-sec/2014/q4/278
seclists.org
http://seclists.org/oss-sec/2014/q4/300
www.oracle.com
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
www.oracle.com
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
www.securityfocus.com
http://www.securityfocus.com/bid/70391
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1151307
More from Tigervnc
9.8
CVE-2026-34352
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect…
9.8
CVE-2014-0011
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a…
9.8
CVE-2017-5581
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle…
9.8
CVE-2014-8241
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to…
8.8
CVE-2017-7393
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution