{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "ZRLE decoding heap-based buffer overflow in vncviewer",
    "tracking": {
      "current_release_date": "2026-07-28T07:23:35+00:00",
      "generator": {
        "date": "2026-07-28T07:23:35+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.1.0"
        }
      },
      "id": "CVE-2014-0011",
      "initial_release_date": "2014-03-19T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-07-28T07:23:35+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 5.11",
            "product": {
              "name": "Red Hat Enterprise Linux 5.11",
              "product_id": "rhel-5.11.z.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:5"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 6-els",
            "product": {
              "name": "Red Hat Enterprise Linux 6-els",
              "product_id": "rhel-6-els.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:6"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 7.0",
            "product": {
              "name": "Red Hat Enterprise Linux 7.0",
              "product_id": "rhel-7.0.els",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:rhel_els:7"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc",
            "product": {
              "name": "tigervnc",
              "product_id": "tigervnc",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-debuginfo",
            "product": {
              "name": "tigervnc-debuginfo",
              "product_id": "tigervnc-debuginfo",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-debuginfo"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-icons",
            "product": {
              "name": "tigervnc-icons",
              "product_id": "tigervnc-icons",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-icons"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-license",
            "product": {
              "name": "tigervnc-license",
              "product_id": "tigervnc-license",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-license"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-server",
            "product": {
              "name": "tigervnc-server",
              "product_id": "tigervnc-server",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-server"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-server-applet",
            "product": {
              "name": "tigervnc-server-applet",
              "product_id": "tigervnc-server-applet",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-server-applet"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-server-minimal",
            "product": {
              "name": "tigervnc-server-minimal",
              "product_id": "tigervnc-server-minimal",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-server-minimal"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc-server-module",
            "product": {
              "name": "tigervnc-server-module",
              "product_id": "tigervnc-server-module",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc-server-module"
              }
            }
          },
          {
            "category": "product_version",
            "name": "tigervnc",
            "product": {
              "name": "tigervnc",
              "product_id": "tigervnc.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/tigervnc?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "vnc",
            "product": {
              "name": "vnc",
              "product_id": "vnc.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/vnc?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc"
        },
        "product_reference": "tigervnc",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc"
        },
        "product_reference": "tigervnc",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-debuginfo as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc-debuginfo"
        },
        "product_reference": "tigervnc-debuginfo",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-icons as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-icons"
        },
        "product_reference": "tigervnc-icons",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-license as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-license"
        },
        "product_reference": "tigervnc-license",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc-server"
        },
        "product_reference": "tigervnc-server",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-server"
        },
        "product_reference": "tigervnc-server",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server-applet as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc-server-applet"
        },
        "product_reference": "tigervnc-server-applet",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server-applet as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-server-applet"
        },
        "product_reference": "tigervnc-server-applet",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server-minimal as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-server-minimal"
        },
        "product_reference": "tigervnc-server-minimal",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server-module as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc-server-module"
        },
        "product_reference": "tigervnc-server-module",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc-server-module as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc-server-module"
        },
        "product_reference": "tigervnc-server-module",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc.src as a component of Red Hat Enterprise Linux 7.0",
          "product_id": "rhel-7.0.els:tigervnc.src"
        },
        "product_reference": "tigervnc.src",
        "relates_to_product_reference": "rhel-7.0.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tigervnc.src as a component of Red Hat Enterprise Linux 6-els",
          "product_id": "rhel-6-els.els:tigervnc.src"
        },
        "product_reference": "tigervnc.src",
        "relates_to_product_reference": "rhel-6-els.els"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vnc.src as a component of Red Hat Enterprise Linux 5.11",
          "product_id": "rhel-5.11.z.els:vnc.src"
        },
        "product_reference": "vnc.src",
        "relates_to_product_reference": "rhel-5.11.z.els"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0011",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2014-01-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-5.11.z.els:vnc.src",
            "rhel-6-els.els:tigervnc",
            "rhel-6-els.els:tigervnc-debuginfo",
            "rhel-6-els.els:tigervnc-server",
            "rhel-6-els.els:tigervnc-server-applet",
            "rhel-6-els.els:tigervnc-server-module",
            "rhel-6-els.els:tigervnc.src",
            "rhel-7.0.els:tigervnc-icons"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the tigervnc packages as shipped with Red Hat Enterprise Linux 6, and the vnc packages as shipped with Red Hat Enterprise Linux 5.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "rhel-7.0.els:tigervnc",
          "rhel-7.0.els:tigervnc-license",
          "rhel-7.0.els:tigervnc-server",
          "rhel-7.0.els:tigervnc-server-applet",
          "rhel-7.0.els:tigervnc-server-minimal",
          "rhel-7.0.els:tigervnc-server-module",
          "rhel-7.0.els:tigervnc.src"
        ],
        "known_not_affected": [
          "rhel-5.11.z.els:vnc.src",
          "rhel-6-els.els:tigervnc",
          "rhel-6-els.els:tigervnc-debuginfo",
          "rhel-6-els.els:tigervnc-server",
          "rhel-6-els.els:tigervnc-server-applet",
          "rhel-6-els.els:tigervnc-server-module",
          "rhel-6-els.els:tigervnc.src",
          "rhel-7.0.els:tigervnc-icons"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0011"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0011"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0011"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "rhel-7.0.els:tigervnc",
            "rhel-7.0.els:tigervnc-license",
            "rhel-7.0.els:tigervnc-server",
            "rhel-7.0.els:tigervnc-server-applet",
            "rhel-7.0.els:tigervnc-server-minimal",
            "rhel-7.0.els:tigervnc-server-module",
            "rhel-7.0.els:tigervnc.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "version": "2.0",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "baseScore": 5.1
          },
          "products": [
            "rhel-5.11.z.els:vnc.src",
            "rhel-6-els.els:tigervnc",
            "rhel-6-els.els:tigervnc-debuginfo",
            "rhel-6-els.els:tigervnc-server",
            "rhel-6-els.els:tigervnc-server-applet",
            "rhel-6-els.els:tigervnc-server-module",
            "rhel-6-els.els:tigervnc.src",
            "rhel-7.0.els:tigervnc",
            "rhel-7.0.els:tigervnc-icons",
            "rhel-7.0.els:tigervnc-license",
            "rhel-7.0.els:tigervnc-server",
            "rhel-7.0.els:tigervnc-server-applet",
            "rhel-7.0.els:tigervnc-server-minimal",
            "rhel-7.0.els:tigervnc-server-module",
            "rhel-7.0.els:tigervnc.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhel-5.11.z.els:vnc.src",
            "rhel-6-els.els:tigervnc",
            "rhel-6-els.els:tigervnc-debuginfo",
            "rhel-6-els.els:tigervnc-server",
            "rhel-6-els.els:tigervnc-server-applet",
            "rhel-6-els.els:tigervnc-server-module",
            "rhel-6-els.els:tigervnc.src",
            "rhel-7.0.els:tigervnc",
            "rhel-7.0.els:tigervnc-icons",
            "rhel-7.0.els:tigervnc-license",
            "rhel-7.0.els:tigervnc-server",
            "rhel-7.0.els:tigervnc-server-applet",
            "rhel-7.0.els:tigervnc-server-minimal",
            "rhel-7.0.els:tigervnc-server-module",
            "rhel-7.0.els:tigervnc.src"
          ]
        }
      ],
      "title": "ZRLE decoding heap-based buffer overflow in vncviewer"
    }
  ]
}