Back

Gentoo: GLSA-201411-03: TigerVNC: User-assisted execution of arbitrary code

Date 05 Nov 2014

Category Gentoo Linux Distribution - Security Advisories

Posted By LinuxSecurity Advisories

A buffer overflow in TigerVNC could result in execution of arbitrary code or Denial of Service.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201411-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: TigerVNC: User-assisted execution of arbitrary code
     Date: November 05, 2014
     Bugs: #505170
       ID: 201411-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A buffer overflow in TigerVNC could result in execution of arbitrary
code or Denial of Service.

Background
==========

TigerVNC is a high-performance VNC server/client.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  net-misc/tigervnc            < 1.3.1                    >= 1.3.1

Description
===========

Two boundary errors in TigerVNC could lead to a heap-based buffer
overflow.

Impact
======

A remote attacker could entice a user to connect to a malicious VNC
server using TigerVNC, possibly resulting in execution of arbitrary
code with the privileges of the process or a Denial of Service
condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All TigerVNC users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=net-misc/tigervnc-1.3.1"

References
==========

[ 1 ] CVE-2014-0011
      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0011

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/glsa-201411-03.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5