CVE-2008-4770

RealVNC VNC Free 4.0-4.1.2, Enterprise E4.0-E4.4.2, Personal P4.0-P4.4.2 - RCE via RFB Protocol

Title source: llm
STIX 2.1

Description

The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."

References (17)

Core 17
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200903-17.xml
Vendor Advisory x_refsource_confirm
http://www.realvnc.com/products/upgrade.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33689
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34184
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31832
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45969
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/33263
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32317
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2868
Various Sources mailing-list x_refsource_mlist
http://www.realvnc.com/pipermail/vnc-list/2008-November/059432.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47937
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9367
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-0261.html

Scores

EPSS 0.0405
EPSS Percentile 89.5%

Details

CWE
CWE-20
Status published
Products (6)
realvnc/realvnc 4.0
realvnc/realvnc 4.1.2
realvnc/realvnc 4.4.2
realvnc/realvnc e4.0
realvnc/realvnc p4.0
realvnc/realvnc p4.4.2
Published Jan 16, 2009
Tracked Since Feb 18, 2026