VulnerabilityModified

CVE-2009-0388

HIGH 10.0EPSS 13.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 13.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 13.33% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-189
Affected: tightvnc/tightvnc · ultravnc/ultravnc
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.