It was found that vncconnectionservermessage() and vnccolormapset() functions do not check for integer overflow properly, leading to a malicious server being able to overwrite parts of the client memory, possibly leading to remote code execution under privileges of user running the VNC client.

Upstream bug:

https://bugzilla.gnome.org/showbug.cgi?id=778050

Upstream patch:

https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590

It was found that gtk-vnc does not properly check boundaries of subrectangle-containing tiles. A malicious server can use this to overwrite parts of the client memory, potentially leading to code execution under privileges of the user running the VNC client.

Upstream bug:

https://bugzilla.gnome.org/showbug.cgi?id=778048

Upstream patch:

https://git.gnome.org/browse/gtk-vnc/commit/?id=ea0386933214c9178

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.