Published: 28/02/2017 Updated: 05/01/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC prior to 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tigervnc tigervnc

Synopsis Moderate: tigervnc security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for tigervnc is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ...

Debian Bug report logs - #852213 tigervnc: CVE-2017-5581: Buffer overflow in ModifiablePixelBuffer::fillRect Package: src:tigervnc; Maintainer for src:tigervnc is TigerVNC Packaging Team <pkg-tigervnc-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 22 Jan 2017 15:27:01 ...

Buffer overflow in ModifiablePixelBuffer::fillRectA buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service (CVE-2017-5581) VNC server can crash when TLS handshake terminates early:A denial of service fla ...

A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service ...

CWE-119 https://github.com/TigerVNC/tigervnc/releases/tag/v1.7.1 https://github.com/TigerVNC/tigervnc/pull/399 https://github.com/TigerVNC/tigervnc/commit/18c020124ff1b2441f714da2017f63dba50720ba http://www.securityfocus.com/bid/95789 http://www.openwall.com/lists/oss-security/2017/01/25/6 http://www.openwall.com/lists/oss-security/2017/01/22/1 https://security.gentoo.org/glsa/201702-19 https://access.redhat.com/errata/RHSA-2017:2000 http://rhn.redhat.com/errata/RHSA-2017-0630.html https://access.redhat.com/errata/RHSA-2017:0630 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2017-879.html

CVE-2017-5581

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect