CVE-2017-5884: High severity Fedoraproject Fedora vulnerability
gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.
Other sources
It was found that gtk-vnc does not properly check boundaries of subrectangle-containing tiles. A malicious server can use this to overwrite parts of the client memory, potentially leading to code execution under privileges of the user running the VNC client.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=778048
Upstream patch:
https://git.gnome.org/browse/gtk-vnc/commit/?id=ea0386933214c9178
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gtk-vncto a version that resolves this vulnerability.Fixed in 0.7.0Patch 778048
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5884?
CVE-2017-5884 is classified as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2017-5884?
To fix CVE-2017-5884, update gtk-vnc to version 0.7.0 or later.
Which versions of gtk-vnc are affected by CVE-2017-5884?
CVE-2017-5884 affects gtk-vnc versions before 0.7.0.
Can CVE-2017-5884 be exploited remotely?
Yes, CVE-2017-5884 can be exploited by a remote attacker through crafted tile coordinates.
What applications are impacted by CVE-2017-5884?
CVE-2017-5884 impacts applications using gtk-vnc, particularly on Fedora 25 and versions of gtk-vnc up to 0.6.0.