Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gtk-vnc | Aug 30, 2017 | Feb 28, 2017 |
| Centos_linux | — | Upgrade gtk-vnc-pythonUpgrade gtk-vnc2-develUpgrade gtk-vnc2Upgrade gtk-vncUpgrade gvnc-toolsUpgrade gvncpulse-develUpgrade gvncpulseUpgrade gtk-vnc-develUpgrade gvnc-develUpgrade gtk-vnc-debuginfoUpgrade gvnc | Aug 28, 2019 | Feb 28, 2017 |
| Debian | — | Upgrade gtk-vnc | Mar 31, 2017 | Feb 9, 2017 |
| Freebsd | — | Upgrade gtk-vnc | Feb 12, 2017 | Feb 11, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade gtk-vnc2 | Nov 30, 2017 | Feb 28, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gtk-vnc2 | Nov 30, 2017 | Feb 28, 2017 |
| Oracle Solaris | — | Upgrade library/desktop/gtk-vnc to version 0.7.0-0.175.3.29.0.2.0 on Solaris 11.3 | Feb 22, 2018 | Feb 28, 2017 |
| Oracle_linux | — | Upgrade gtk-vnc2Upgrade gtk-vnc-pythonUpgrade gtk-vnc2-develUpgrade gvncpulseUpgrade gtk-vncUpgrade gvnc-develUpgrade gtk-vnc-develUpgrade gvnc-toolsUpgrade gvncUpgrade gvncpulse-devel | Aug 8, 2017 | Feb 1, 2017 |
| Redhat_linux | — | Upgrade gvnc-develUpgrade gtk-vncUpgrade gvncpulse-develUpgrade gvncpulseUpgrade gvncUpgrade gtk-vnc-debuginfoUpgrade gtk-vnc-develUpgrade gvnc-toolsUpgrade gtk-vnc-pythonNo solution existsUpgrade gtk-vnc2-develUpgrade gtk-vnc2 | Aug 3, 2017 | Feb 9, 2017 |
| Suse | — | Upgrade typelib-1_0-GtkVnc-2_0Upgrade libgvnc-1_0-0Upgrade gtk-vnc-langUpgrade typelib-1_0-GVncPulse-1_0Upgrade libgtk-vnc-1_0-0Upgrade gtk-vnc2-develUpgrade typelib-1_0-GtkVnc-1_0Upgrade typelib-1_0-GVnc-1_0Upgrade libgtk-vnc-2_0-0Upgrade python-gtk-vncUpgrade gtk-vnc-develUpgrade libgvncpulse-1_0-0 | May 20, 2018 | Feb 9, 2017 |
| Ubuntu | — | Upgrade libgvnc-1.0-0Upgrade libgtk-vnc-2.0-0Upgrade libgtk-vnc-1.0-0 | Feb 21, 2017 | Feb 9, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub