PublicDateAtUSN: 2017-02-07
Candidate: CVE-2017-5885
PublicDate: 2017-02-28 18:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5885
 http://openwall.com/lists/oss-security/2017/02/05/5
 https://ubuntu.com/security/notices/USN-3203-1
Description:
 Multiple integer overflows in the (1) vnc_connection_server_message and (2)
 vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to
 cause a denial of service (crash) or possibly execute arbitrary code via
 vectors involving SetColorMapEntries, which triggers a buffer overflow.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854450
 https://bugzilla.gnome.org/show_bug.cgi?id=778050
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_gtk-vnc:
 upstream: https://git.gnome.org/browse/gtk-vnc/commit/?id=661a676e556fef17e53c09b9e2656adc80eb0acf
 upstream: https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e
upstream_gtk-vnc: released (0.6.0-3)
precise_gtk-vnc: released (0.5.0-1ubuntu1.1)
trusty_gtk-vnc: released (0.5.3-0ubuntu2.1)
trusty/esm_gtk-vnc: DNE (trusty was released [0.5.3-0ubuntu2.1])
vivid/stable-phone-overlay_gtk-vnc: DNE
vivid/ubuntu-core_gtk-vnc: DNE
xenial_gtk-vnc: released (0.5.3-1.3ubuntu2.1)
yakkety_gtk-vnc: released (0.6.0-1ubuntu1.1)
devel_gtk-vnc: not-affected (0.6.0-3)