CVE-2017-7393
HighSummary
In TigerVNC 1.7.1, an authenticated client can cause a double free, leading to denial of service or potentially code execution.
Risk Assessment
This vulnerability may lead to significant service disruptions and create a risk of malicious code execution on the system.
Recommendation
It is recommended to upgrade to a newer version of TigerVNC to mitigate the risks associated with this vulnerability.
Other vulnerabilities in TigerVNC 1.7.1
See all- CVE-2017-7396High
In TigerVNC version 1.7.1, a vulnerability allows an unauthenticated client to cause a small memory leak on the server.
- CVE-2017-7394High
In TigerVNC 1.7.1, unauthenticated users can crash the server by sending long usernames.
- CVE-2017-7392High
In TigerVNC 1.7.1, there is a vulnerability that allows an unauthenticated client to cause a small memory leak on the server.
- CVE-2016-10207High
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service by terminating a TLS handshake early, leading to invalid memory access and server crash.
- CVE-2014-8240High
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow.
- CVE-2017-5581Critical
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before version 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
- CVE-2014-8241Critical
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.
Original NVD description (English source)
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.