SB2017022806 - Remote code execution in gtk-vnc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017022806

SB2017022806 - Remote code execution in gtk-vnc

Published: February 28, 2017 Updated: August 3, 2020

Security Bulletin ID SB2017022806
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2017-5884)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.

2) Integer overflow (CVE-ID: CVE-2017-5885)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References