NVD Vulnerability Detail

CVE-2017-5885

Summary	Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving SetColorMapEntries, which triggers a buffer overflow.
Publication Date	March 1, 2017, 3:59 a.m.
Registration Date	Jan. 26, 2021, 1:26 p.m.
Last Update	Nov. 21, 2024, 12:28 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:25:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:gnome:gtk-vnc::::::::			0.6.0

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2017/02/03/5	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2017/02/03/5	Mailing List Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2017/02/05/5	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2017/02/05/5	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/96016	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/96016	Third Party Advisory VDB Entry
7	https://access.redhat.com/errata/RHSA-2017:2258
8	https://access.redhat.com/errata/RHSA-2017:2258
9	https://bugzilla.gnome.org/show_bug.cgi?id=778050	Exploit Issue Tracking Vendor Advisory
10	https://bugzilla.gnome.org/show_bug.cgi?id=778050	Exploit Issue Tracking Vendor Advisory
11	https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e	Issue Tracking Patch Vendor Advisory
12	https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e	Issue Tracking Patch Vendor Advisory
13	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/
14	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-190	整数オーバーフローまたはラップアラウンド	https://cwe.mitre.org/data/definitions/190.html

JVN Vulnerability Information

gtk-vnc の複数の関数における整数オーバーフローの脆弱性

Title	gtk-vnc の複数の関数における整数オーバーフローの脆弱性
Summary	gtk-vnc の (1) vnc_connection_server_message および (2) vnc_color_map_set 関数には、整数オーバーフローの脆弱性が存在します。
Possible impacts	リモートサーバにより、バッファオーバーフローを誘発する SetColorMapEntries に関する問題によって、サービス運用妨害 (クラッシュ) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 7, 2017, midnight
Registration Date	March 23, 2017, 12:29 p.m.
Last Update	March 23, 2017, 12:29 p.m.

Affected System

Fedora Project

Fedora 25

GNOME Project

gtk-vnc 0.7.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-5885	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5885
National Vulnerability Database (NVD)
2	CVE-2017-5885	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5885

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-190	https://cwe.mitre.org/data/definitions/190.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 778050	https://bugzilla.gnome.org/show_bug.cgi?id=778050
Fedora Update Notification
2	FEDORA-2017-ab04a91edd	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/
GNOME GIT REPOSITORY
3	Correctly validate color map range indexes	https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590fcb7bae4ce6e7344963e

Change Log

No	Changed Details	Date of change
0	[2017年03月23日] 掲載	Feb. 17, 2018, 10:37 a.m.