CVE-2017-1000044
CriticalSummary
gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.
Risk Assessment
Memory corruption can lead to unpredictable application behavior, posing risks to system stability and data security.
Recommendation
It is recommended to update gtk-vnc to the latest version to eliminate the framebuffer boundary issue.
Other vulnerabilities in gtk-vnc
See all- CVE-2017-5884High
In versions of gtk-vnc before 0.7.0, the boundaries of subrectangle-containing tiles are not properly checked, allowing remote servers to execute arbitrary code via manipulated x, y coordinates in crafted rre, hextile, or copyrect tiles.
- CVE-2017-5885Critical
Multiple integer overflows in the vnc_connection_server_message and vnc_color_map_set functions in gtk-vnc before version 0.7.0 may allow remote servers to cause a denial of service (crash) or potentially execute arbitrary code via vectors involving SetColorMapEntries, leading to a buffer overflow.
Original NVD description (English source)
gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when rendering