参照： Official debian advisory, NVD, CVE.org · CVE 詳細
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2018-7225 not yet assigned priority: Debian including 3 source packages (libvncserver, tightvnc, vino), 12 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 12.
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.