SB2017040416 - Fedora 25 update for tigervnc
Published: April 4, 2017 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2017-7392)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the server. A remote attacker can perform a denial of service attack.
2) Double Free (CVE-ID: CVE-2017-7393)
The vulnerability allows a remote authenticated user to execute arbitrary code.
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
3) Input validation error (CVE-ID: CVE-2017-7394)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.
4) Integer overflow (CVE-ID: CVE-2017-7395)
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.
5) Memory leak (CVE-ID: CVE-2017-7396)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the server. A remote attacker can perform a denial of service attack.
Remediation
Install update from vendor's website.