Red Hat Security AdvisoryRHSA-2017:2258
gtk-vnc security, bug fix, and enhancement update
Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc2-0.7.0-2.el7, gvnc-0.7.0-2.el7
- Red Hat Enterprise Linux Client Optional (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc-devel-0.7.0-2.el7, gtk-vnc-python-0.7.0-2.el7 +5
- Red Hat Enterprise Linux Server (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc2-0.7.0-2.el7, gtk-vnc2-0.7.0-2.el7.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc-0.7.0-2.el7.ppc, gtk-vnc-devel-0.7.0-2.el7 +11
- Red Hat Enterprise Linux Workstation (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc2-0.7.0-2.el7, gvnc-0.7.0-2.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) gtk-vnc-0.7.0-2.el7, gtk-vnc-devel-0.7.0-2.el7, gtk-vnc-python-0.7.0-2.el7 +5
Fixes 2 records
Priority MEDIUM 50
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04985 · Published 2017-02-28 · Partial fix CWE-190
Priority LOW 39
gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyr…
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02317 · Published 2017-02-28 · Partial fix CWE-118
