CVE-2018-7225

Name of the Vulnerable Software and Affected Versions LibVNCServer versions prior to 0.9.12

Description The issue is related to insufficient sanitization of VNC packet input data in the rfbProcessClientNormalMessage() function of the LibVNCServer library. This can be exploited by a remote attacker to cause a denial of service and gain unauthorized access to sensitive data. The vulnerability is triggered by specially crafted VNC packets, which can lead to access to uninitialized and potentially sensitive data, or possibly other impacts such as an integer overflow.

Recommendations For LibVNCServer versions prior to 0.9.12, update to version 0.9.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the rfbProcessClientNormalMessage() function to minimize the risk of exploitation.