CVE-2008-4770

The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."

• CWE-20

• http://secunia.com/advisories/32317
• http://secunia.com/advisories/33689
• http://secunia.com/advisories/34184
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200903-17.xml
• http://www.realvnc.com/pipermail/vnc-list/2008-November/059432.html
• http://www.realvnc.com/products/free/4.1/release-notes.html
• http://www.realvnc.com/products/upgrade.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0261.html
• http://www.securityfocus.com/bid/31832
• http://www.securityfocus.com/bid/33263
• http://www.vupen.com/english/advisories/2008/2868
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45969
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47937
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9367
• https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01025.html
• http://secunia.com/advisories/32317
• http://secunia.com/advisories/33689
• http://secunia.com/advisories/34184
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-140455-01-1Patch, Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248526-1Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200903-17.xml
• http://www.realvnc.com/pipermail/vnc-list/2008-November/059432.html
• http://www.realvnc.com/products/free/4.1/release-notes.html
• http://www.realvnc.com/products/upgrade.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0261.html
• http://www.securityfocus.com/bid/31832
• http://www.securityfocus.com/bid/33263
• http://www.vupen.com/english/advisories/2008/2868
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45969
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47937
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9367
• https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01025.html

Published

Jan 16, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4764Directory traversal vulnerability in the eXtplorer module (c…
• CVE-2008-4765SQL injection vulnerability in pollBooth.php in osCommerce P…
• CVE-2008-4766SQL injection vulnerability in member.php in Oxygen Bulletin…
• CVE-2008-4767Unrestricted file upload vulnerability in the DownloadsPlus …
• CVE-2008-4768SQL injection vulnerability in TLM CMS 3.1 allows remote att…
• CVE-2008-4769Directory traversal vulnerability in the get_category_templa…
• CVE-2008-4771Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX …
• CVE-2008-4772SQL injection vulnerability in main/main.php in QuestCMS all…
• CVE-2008-4773Directory traversal vulnerability in main/main.php in QuestC…
• CVE-2008-4774Cross-site scripting (XSS) vulnerability in main/main.php in…
• CVE-2008-4775Cross-site scripting (XSS) vulnerability in pmd_pdf.php in p…
• CVE-2008-4776libgadu before 1.8.2 allows remote servers to cause a denial…