# CVE-2014-6053: vino: The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c inLibVNCServer 0.9.9 and earlier does not prop...

CVE-2014-6053 is fixed in vino on 1 platform, first by vino 3.22.0-6ubuntu1, released February 19, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2014-6053
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0725
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 23, 2014

## Description

The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c inLibVNCServer 0.9.9 and earlier does not properly handle attempts to send alarge amount of ClientCutText data, which allows remote attackers to causea denial of service (memory consumption or daemon crash) via a craftedmessage that is processed by using a single unchecked malloc.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | vino Ubuntu 18.04.6 LTS (bionic) | 3.22.0-3ubuntu1.1 | [vino 3.22.0-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-vino-3.22.0-3ubuntu1.1.md) | Jun 17, 2020 |
| Linux | vino Ubuntu 20.04 LTS (focal) | 3.22.0-5ubuntu2.1 | [vino 3.22.0-5ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-vino-3.22.0-5ubuntu2.1.md) | Jun 17, 2020 |
| Linux | vino Ubuntu 24.10 (oracular) | 3.22.0-6ubuntu1 | [vino 3.22.0-6ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-vino-3.22.0-6ubuntu1.md) | Feb 19, 2018 |
| Linux | vino Ubuntu 25.04 (plucky) | 3.22.0-6ubuntu1 | [vino 3.22.0-6ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-vino-3.22.0-6ubuntu1.md) | Feb 19, 2018 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo