An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. Upstream commit: https://github.com/LibVNC/libvncserver/commit/8937203441ee241c4ace85da687b7d6633a12365
Created libvncserver tracking bugs for this issue: Affects: epel-7 [bug 1860326] Affects: fedora-all [bug 1860327]
Flaw Summary: When receiving a remote framebuffer (RFB) textchat message, in HandleRFBServerMessage() of libvncclient/rfbproto.c, the routine does not validate the length of the message. The length of the message is immediately used in a call to malloc(). This could result in a memory allocation which is too large and could crash the vnc client, causing a temporary denial-of-service. The patch imposes a 10MB size limit on the textchat length and the routine will fail if it's above that length. I've lowered the Impact to Moderate because triggering this flaw could lead to a temporary denial of service on the client. Exploitation would require a client user to connect to a malicious or compromised VNC server.
vino is notaffected because it does not use the libvncclient functionality of libvncserver and thus the affected code is not shipped in the package; it only uses the server components.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14405
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1811 https://access.redhat.com/errata/RHSA-2021:1811