CVE-2017-5885
CriticalSummary
Multiple integer overflows in the vnc_connection_server_message and vnc_color_map_set functions in gtk-vnc before version 0.7.0 may allow remote servers to cause a denial of service (crash) or potentially execute arbitrary code via vectors involving SetColorMapEntries, leading to a buffer overflow.
Risk Assessment
Organizations may be exposed to system crashes and the possibility of remote code execution, which can lead to serious security implications.
Recommendation
It is recommended to update gtk-vnc to version 0.7.0 or later to mitigate these vulnerabilities.
Other vulnerabilities in gtk-vnc
See all- CVE-2017-5884High
In versions of gtk-vnc before 0.7.0, the boundaries of subrectangle-containing tiles are not properly checked, allowing remote servers to execute arbitrary code via manipulated x, y coordinates in crafted rre, hextile, or copyrect tiles.
- CVE-2017-1000044Critical
gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.
Original NVD description (English source)
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.