CVE-2014-6051: Debian Linux

High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days.

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

Affected products

• Debian Debian Linux: version 7.0 only
• Fedoraproject Fedora: version 20 only; version 21 only
• Libvncserver Libvncserver: up to and including 0.9.9
• Oracle Solaris: version 11.3 only
• Red Hat Enterprise Linux Server Aus: version 6.5 only
• Red Hat Enterprise Linux Server Eus: version 6.5.z only

Published 2014-09-30. Last modified 2026-06-17.