A stack based buffer overflow flaw was found in guac client plug-in protocol handling functionality of libguac, a common library used by all C components of Guacamole. A remote attacker could provide a specially-crafted protocol specification to the guac client plug-in that, when processed would lead to guac client crash (denial of service).

References: [1] http://www.openwall.com/lists/oss-security/2012/09/11/3 [2] http://www.openwall.com/lists/oss-security/2012/09/11/7

Upstream patch: [3] http://guac-dev.org/trac/changeset/7dcefa744b4a38825619c00ae8b47e5bae6e38c0/libguac