CVE-2017-5885

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-5885
Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.openwall.com/lists/oss-security/2017/02/03/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/05/5 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/96016 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2258
https://bugzilla.gnome.org/show_bug.cgi?id=778050 Exploit Issue Tracking Vendor Advisory
https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e Issue Tracking Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/
Configurations

Configuration 1 (hide)

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:gnome:gtk-vnc:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:29

Type Values Removed Values Added
Summary An integer overflow flaw was found in gtk-vnc. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library. Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2017-5885', 'name': 'https://access.redhat.com/security/cve/CVE-2017-5885', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1418952', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1418952', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 15:17

Type Values Removed Values Added
Summary Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow. An integer overflow flaw was found in gtk-vnc. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library.
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/', 'name': 'FEDORA-2017-ab04a91edd', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • (MISC) https://access.redhat.com/security/cve/CVE-2017-5885 -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/ -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1418952 -
Information

Published : 2017-02-28 18:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-5885

Mitre link : CVE-2017-5885

CVE.ORG link : CVE-2017-5885

JSON object : View

Products Affected

fedoraproject

  • fedora

gnome

  • gtk-vnc
CWE
CWE-190

Integer Overflow or Wraparound