Advisories ยป MGASA-2017-0057

Updated gtk-vnc packages fix security vulnerability

Publication date: 20 Feb 2017
Modification date: 20 Feb 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-5884 , CVE-2017-5885

Description

It was found that gtk-vnc code does not properly check boundaries of
subrectangle-containing tiles. A malicious server can use this to
overwrite parts of the client memory (CVE-2017-5884).

In addition, the vnc_connection_server_message() and vnc_color_map_set()
functions do not check for integer overflow properly, leading to a
malicious server being able to overwrite parts of the client memory
(CVE-2017-5885).
                

References

SRPMS

5/core