Alfredo Ortega discovered a flaw in Vinagre's use of format strings. Aremote attacker could exploit this vulnerability if they tricked a userinto connecting to a malicious VNC server, or opening a specially craftedURI with Vinagre. In Ubuntu 8.04, it was possible to execute arbitrarycode with user privileges. In Ubuntu 8.10, Vinagre would simply abort,leading to a denial of service.
The problem can be corrected by updating your system to the following
To update your system, please follow these instructions:
After a standard system upgrade you need to restart Vinagre to effectthe necessary changes.