Published: 28/02/2017 Updated: 01/02/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The Xvnc server in TigerVNC allows remote malicious users to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opensuse leap 42.1
opensuse leap 42.2
tigervnc tigervnc 0.0.91
tigervnc tigervnc 0.0.90
tigervnc tigervnc 1.7
tigervnc tigervnc 1.0.1
tigervnc tigervnc 1.3
tigervnc tigervnc 1.1.0
tigervnc tigervnc 1.3.1
tigervnc tigervnc 1.0

Synopsis Moderate: tigervnc security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for tigervnc is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ...

Buffer overflow in ModifiablePixelBuffer::fillRectA buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service (CVE-2017-5581) VNC server can crash when TLS handshake terminates early:A denial of service fla ...

A denial of service flaw was found in the TigerVNC's Xvnc server A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early ...

CWE-119 https://github.com/TigerVNC/tigervnc/commit/8aa4bc53206c2430bbf0c8f4b642f59a379ee649 https://bugzilla.suse.com/show_bug.cgi?id=1023012 http://www.securityfocus.com/bid/96012 http://www.openwall.com/lists/oss-security/2017/02/05/2 http://www.openwall.com/lists/oss-security/2017/02/02/22 http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00020.html https://access.redhat.com/errata/RHSA-2017:2000 http://rhn.redhat.com/errata/RHSA-2017-0630.html https://security.gentoo.org/glsa/201801-13 https://access.redhat.com/errata/RHSA-2017:0630 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2017-879.html

CVE-2016-10207

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect