Branch p8 update bulletin.

Package gtk-vnc updated to version 0.7.0-alt0.M80P.1 for branch p8 in task 178098.

Published: 2017-02-28
Modified: 2024-11-21

CVE-2017-5884

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.

Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Published: 2017-02-28
Modified: 2024-11-21

CVE-2017-5885

Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Version: 2.1.1

Branch p8 update on 2017-02-16

ALT-BU-2017-2935-1

ALT-PU-2017-1167-1

Closed vulnerabilities

CVE-2017-5884

CVE-2017-5885