CVE-2017-7393: Double Free
In TigerVNC (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to a crash of the TigerVNC server.
Upstream patch:
https://github.com/TigerVNC/tigervnc/pull/438/commits/f3afa24da144409a3c3a0e35913112583d987671
Upstream bug:
https://github.com/TigerVNC/tigervnc/issues/437
Other sources
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TigerVNCto a version that resolves this vulnerability.Fixed in 1.7.1Patch f3afa24da144409a3c3a0e35913112583d987671
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7393?
CVE-2017-7393 is considered a medium severity vulnerability as it allows an authenticated client to cause a crash of the TigerVNC server.
How do I fix CVE-2017-7393?
To fix CVE-2017-7393, users should upgrade to the latest version of TigerVNC that contains the patch addressing this vulnerability.
Who is affected by CVE-2017-7393?
CVE-2017-7393 affects users running TigerVNC version 1.7.1.
What can attackers do with CVE-2017-7393?
Attackers exploiting CVE-2017-7393 can cause a denial of service by triggering a double free condition that crashes the TigerVNC server.
Is CVE-2017-7393 related to authentication?
Yes, CVE-2017-7393 requires authentication, allowing only authenticated clients to exploit the vulnerability.