VIR Vulnerability Intelligence Relay

CVE-2011-0905

low
Published 2011-05-10 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
3.5

Description

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 0
sid Fixed 0
forky Fixed 0
bullseye Fixed 0
bookworm Fixed 0

Application impact
VendorProductVersionsFixed
david_kingvino2.10
david_kingvino2.11
david_kingvino2.12
david_kingvino2.13
david_kingvino2.13.5
david_kingvino2.14
david_kingvino2.15
david_kingvino2.16
david_kingvino2.17
david_kingvino2.17.2
david_kingvino2.17.4
david_kingvino2.17.5
david_kingvino2.17.92
david_kingvino2.18
david_kingvino2.18.1
david_kingvino2.19
david_kingvino2.19.5
david_kingvino2.19.90
david_kingvino2.19.92
david_kingvino2.20
david_kingvino2.20.1
david_kingvino2.21
david_kingvino2.21.1
david_kingvino2.21.2
david_kingvino2.21.3
david_kingvino2.21.90
david_kingvino2.21.91
david_kingvino2.21.92
david_kingvino2.22
david_kingvino2.22.1
david_kingvino2.22.2
david_kingvino2.23
david_kingvino2.23.5
david_kingvino2.23.90
david_kingvino2.23.91
david_kingvino2.23.92
david_kingvino2.24
david_kingvino2.24.1
david_kingvino2.25
david_kingvino2.25.3
david_kingvino2.25.4
david_kingvino2.25.5
david_kingvino2.25.90
david_kingvino2.25.91
david_kingvino2.25.92
david_kingvino2.26
david_kingvino2.26.1
david_kingvino2.26.2
david_kingvino2.27
david_kingvino2.27.5
david_kingvino2.27.90
david_kingvino2.27.91
david_kingvino2.27.92
david_kingvino2.28
david_kingvino2.28.1
david_kingvino2.28.2
david_kingvino2.32.0
david_kingvino2.32.1
david_kingvino3.0.0
david_kingvino3.0.1
david_kingvino3.1

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.