CVE-2014-8240 — tigervnc: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

Back Back to CVE browser

HIGH

tigervnc: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

Published Oct 16, 2014

7.5

HIGH

CVSS 2.0

EPSS 3.55%

Description

Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051.

Affected products

Red Hat Enterprise Linux 7

tigervnc-0:1.3.1-3.el7

Fixed · RHSA-2015:2233
Red Hat Enterprise Linux 5

vnc

Will not fix
Red Hat Enterprise Linux 6

tigervnc

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	tigervnc-0:1.3.1-3.el7	Fixed	RHSA-2015:2233
Red Hat Enterprise Linux 5	vnc	Will not fix	n/a
Red Hat Enterprise Linux 6	tigervnc	Will not fix	n/a

Remediation

Red Hat statement

This issue affects the version of tigervnc as shipped with Red Hat Enterprise Linux 5 and 6. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5 and 6.

Metrics

3.55% 0.03547

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03547

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.55% (0.03547)	88.92th	v5 (v2026.06.15)
Jun 15, 2026	3.48% (0.03479)	87.54th	v5 (v2026.06.15)
Mar 30, 2025	0.86% (0.00857)	72.88th	v4 (v2025.03.14)
Mar 29, 2025	2.19% (0.02193)	73.95th	v4 (v2025.03.14)
Mar 17, 2025	0.94% (0.00940)	74.64th	v4 (v2025.03.14)
Dec 12, 2024	1.46% (0.01463)	87.26th	v3 (v2023.03.01)
Apr 11, 2024	1.46% (0.01463)	86.50th	v3 (v2023.03.01)
Jun 23, 2023	1.59% (0.01590)	85.52th	v3 (v2023.03.01)
Mar 7, 2023	1.55% (0.01552)	85.09th	v3 (v2023.03.01)
Mar 6, 2023	3.28% (0.03275)	84.29th	v2 (v2022.01.01)
Apr 1, 2022	3.28% (0.03275)	82.69th	v2 (v2022.01.01)
Feb 4, 2022	3.28% (0.03275)	65.37th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-190

Integer Overflow

References (11)

http://seclists.org/oss-sec/2014/q4/278
mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2014/q4/300
mailing-listx_refsource_MLIST
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
x_refsource_CONFIRM
http://www.securityfocus.com/bid/70391
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2014-8240
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1151307
x_refsource_MISCIssue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/96947
vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2014-8240
https://security.gentoo.org/glsa/201612-36
vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2014-8240

Link	Providers	Tags
http://seclists.org/oss-sec/2014/q4/278		mailing-listx_refsource_MLIST
http://seclists.org/oss-sec/2014/q4/300		mailing-listx_refsource_MLIST
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html		x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html		x_refsource_CONFIRM
http://www.securityfocus.com/bid/70391		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2014-8240		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1151307		x_refsource_MISCIssue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/96947		vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2014-8240
https://security.gentoo.org/glsa/201612-36		vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2014-8240