description: UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which can potentially result code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1207.
problem types: CWE-193: Off-by-one Error
affected:
{
product: UltraVNC
vendor: Kaspersky Lab
versions:
status: affected, version: 1.2.2.3
}