CVE-2017-5885
CriticalSummary
Multiple integer overflows in the vnc_connection_server_message and vnc_color_map_set functions in gtk-vnc before version 0.7.0 may allow remote servers to cause a denial of service (crash) or potentially execute arbitrary code via vectors involving SetColorMapEntries, leading to a buffer overflow.
Risk Assessment
Organizations may be exposed to system crashes and the possibility of remote code execution, which can lead to serious security implications.
Recommendation
It is recommended to update gtk-vnc to version 0.7.0 or later to mitigate these vulnerabilities.
Original NVD description (English source)
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.