CVE-2017-5884
HighSummary
In versions of gtk-vnc before 0.7.0, the boundaries of subrectangle-containing tiles are not properly checked, allowing remote servers to execute arbitrary code via manipulated x, y coordinates in crafted rre, hextile, or copyrect tiles.
Risk Assessment
This vulnerability could lead to remote code execution, posing a significant security risk to systems using gtk-vnc.
Recommendation
It is recommended to upgrade gtk-vnc to version 0.7.0 or later to mitigate this vulnerability.
Other vulnerabilities in gtk-vnc
See all- CVE-2017-1000044Critical
gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.
- CVE-2017-5885Critical
Multiple integer overflows in the vnc_connection_server_message and vnc_color_map_set functions in gtk-vnc before version 0.7.0 may allow remote servers to cause a denial of service (crash) or potentially execute arbitrary code via vectors involving SetColorMapEntries, leading to a buffer overflow.
Original NVD description (English source)
gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.