Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gtk-vnc | Aug 30, 2017 | Feb 28, 2017 |
| Centos_linux | — | Upgrade gtk-vnc-debuginfoUpgrade gvnc-develUpgrade gvncUpgrade gtk-vnc-develUpgrade gvncpulseUpgrade gvnc-toolsUpgrade gvncpulse-develUpgrade gtk-vncUpgrade gtk-vnc2Upgrade gtk-vnc2-develUpgrade gtk-vnc-python | Aug 28, 2019 | Feb 28, 2017 |
| Debian | — | Upgrade gtk-vnc | Mar 31, 2017 | Feb 9, 2017 |
| Freebsd | — | Upgrade gtk-vnc | Feb 12, 2017 | Feb 11, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gtk-vnc2 | Nov 30, 2017 | Feb 28, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gtk-vnc2 | Nov 30, 2017 | Feb 28, 2017 |
| Oracle Solaris | — | Upgrade library/desktop/gtk-vnc to version 0.7.0-0.175.3.29.0.2.0 on Solaris 11.3 | Feb 22, 2018 | Feb 28, 2017 |
| Oracle_linux | — | Upgrade gtk-vnc-develUpgrade gvnc-develUpgrade gtk-vnc2Upgrade gtk-vnc-pythonUpgrade gtk-vnc2-develUpgrade gvncpulseUpgrade gvnc-toolsUpgrade gvncUpgrade gtk-vncUpgrade gvncpulse-devel | Aug 8, 2017 | Feb 1, 2017 |
| Redhat_linux | — | Upgrade gvnc-develUpgrade gtk-vnc-debuginfoUpgrade gtk-vncUpgrade gvnc-toolsUpgrade gvncpulse-develUpgrade gvncUpgrade gtk-vnc-develUpgrade gvncpulseUpgrade gtk-vnc2-develUpgrade gtk-vnc-pythonUpgrade gtk-vnc2No solution exists | Aug 3, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade libgtk-vnc-1_0-0Upgrade typelib-1_0-GtkVnc-2_0Upgrade typelib-1_0-GVncPulse-1_0Upgrade gtk-vnc2-develUpgrade typelib-1_0-GVnc-1_0Upgrade libgvnc-1_0-0Upgrade typelib-1_0-GtkVnc-1_0Upgrade gtk-vnc-langUpgrade libgtk-vnc-2_0-0Upgrade libgvncpulse-1_0-0Upgrade python-gtk-vncUpgrade gtk-vnc-devel | May 20, 2018 | Feb 9, 2017 |
| Ubuntu | — | Upgrade libgtk-vnc-2.0-0Upgrade libgvnc-1.0-0Upgrade libgtk-vnc-1.0-0 | Feb 21, 2017 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub