Red Hat Security AdvisoryRHSA-2017:0630
tigervnc security and bug fix update
Released 2017-03-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) tigervnc-1.1.0-24.el6, tigervnc-server-1.1.0-24.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) tigervnc-server-applet-1.1.0-24.el6, tigervnc-server-module-1.1.0-24.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) tigervnc-1.1.0-24.el6, tigervnc-server-1.1.0-24.el6, tigervnc-server-applet-1.1.0-24.el6 +1
- Red Hat Enterprise Linux Server (v. 6) tigervnc-1.1.0-24.el6, tigervnc-server-1.1.0-24.el6
- Red Hat Enterprise Linux Server Optional (v. 6) tigervnc-server-applet-1.1.0-24.el6, tigervnc-server-module-1.1.0-24.el6
- Red Hat Enterprise Linux Workstation (v. 6) tigervnc-1.1.0-24.el6, tigervnc-server-1.1.0-24.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) tigervnc-server-applet-1.1.0-24.el6, tigervnc-server-module-1.1.0-24.el6
Fixes 2 records
Priority MEDIUM 49
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04247 · Published 2017-02-28 · Fixed CWE-119
Priority LOW 39
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03179 · Published 2017-02-28 · Fixed CWE-119
