ID |
CVE-2017-5885
|
Summary |
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:-:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:-:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.1.0:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.2.0:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.3.7:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.3.7:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.3.8:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.3.8:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.4.2:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.4.2:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.5.1:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.5.1:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.5.2:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.5.3:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.5.3:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.5.4:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.5.4:*:*:*:*:*:*:*
-
cpe:2.3:a:gnome:gtk-vnc:0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:gnome:gtk-vnc:0.6.0:*:*:*:*:*:*:*
|
CVSS |
Base: | 7.5 (as of 12-02-2023 - 23:29) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-190 |
CAPEC |
-
Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
PARTIAL |
PARTIAL |
|
cvss-vector
via4
|
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
redhat
via4
|
advisories | bugzilla | id | 1441120 | title | segment fault when connecting a host with no VNC server listening |
| oval | OR | comment | Red Hat Enterprise Linux must be installed | oval | oval:com.redhat.rhba:tst:20070304026 |
AND | comment | Red Hat Enterprise Linux 7 is installed | oval | oval:com.redhat.rhba:tst:20150364027 |
OR | AND | comment | gtk-vnc is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258001 |
comment | gtk-vnc is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258002 |
|
AND | comment | gtk-vnc-devel is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258003 |
comment | gtk-vnc-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258004 |
|
AND | comment | gtk-vnc-python is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258005 |
comment | gtk-vnc-python is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258006 |
|
AND | comment | gtk-vnc2 is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258007 |
comment | gtk-vnc2 is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258008 |
|
AND | comment | gtk-vnc2-devel is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258009 |
comment | gtk-vnc2-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258010 |
|
AND | comment | gvnc is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258011 |
comment | gvnc is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258012 |
|
AND | comment | gvnc-devel is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258013 |
comment | gvnc-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258014 |
|
AND | comment | gvnc-tools is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258015 |
comment | gvnc-tools is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258016 |
|
AND | comment | gvncpulse is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258017 |
comment | gvncpulse is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258018 |
|
AND | comment | gvncpulse-devel is earlier than 0:0.7.0-2.el7 | oval | oval:com.redhat.rhsa:tst:20172258019 |
comment | gvncpulse-devel is signed with Red Hat redhatrelease2 key | oval | oval:com.redhat.rhsa:tst:20172258020 |
|
|
|
|
| rhsa | id | RHSA-2017:2258 | released | 2017-08-01 | severity | Moderate | title | RHSA-2017:2258: gtk-vnc security, bug fix, and enhancement update (Moderate) |
|
| rpms | - gtk-vnc-0:0.7.0-2.el7
- gtk-vnc-debuginfo-0:0.7.0-2.el7
- gtk-vnc-devel-0:0.7.0-2.el7
- gtk-vnc-python-0:0.7.0-2.el7
- gtk-vnc2-0:0.7.0-2.el7
- gtk-vnc2-devel-0:0.7.0-2.el7
- gvnc-0:0.7.0-2.el7
- gvnc-devel-0:0.7.0-2.el7
- gvnc-tools-0:0.7.0-2.el7
- gvncpulse-0:0.7.0-2.el7
- gvncpulse-devel-0:0.7.0-2.el7
|
|
refmap
via4
|
bid | 96016 | confirm | | fedora | FEDORA-2017-ab04a91edd | mlist | - [oss-security] 20170203 CVE request for two input validation flaws in gtk-vnc
- [oss-security] 20170204 Re: CVE request for two input validation flaws in gtk-vnc
|
|
Last major update |
12-02-2023 - 23:29 |
Published |
28-02-2017 - 18:59 |
Last modified |
12-02-2023 - 23:29 |