CVE-2008-5660 Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code vi...
MediumCVSS 6.8
EPSS 9.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME vinagre | = 0.5.0 | No fix listed |
| GNOME vinagre | = 0.5.1 | No fix listed |
| GNOME vinagre | = 2.23.1 | No fix listed |
| GNOME vinagre | = 2.23.2 | No fix listed |
| GNOME vinagre | = 2.23.3 | No fix listed |
| GNOME vinagre | = 2.23.3.1 | No fix listed |
| GNOME vinagre | = 2.23.4 | No fix listed |
| GNOME vinagre | = 2.23.90 | No fix listed |
| GNOME vinagre | = 2.23.91 | No fix listed |
| GNOME vinagre | = 2.23.92 | No fix listed |
| GNOME vinagre | = 2.24.0 | No fix listed |
| GNOME vinagre | = 2.24.1 | No fix listed |
| debian/vinagre(Debian:12) | < 0.5.1-2 | 0.5.1-2 |
References
- 33041 third-party-advisory vendor-advisory
- 33046 third-party-advisory vendor-advisory
- 33082 third-party-advisory vendor-advisory
- www.coresecurity.com exploit
- MDVSA-2008:240 vendor-advisory
- 20081209 CORE-2008-1127 - Vinagre show_error() format string vulnerability mailing-list
- USN-689-1 vendor-advisory
- ADV-2008-3362 vdb-entry
- bugzilla.redhat.com
- 7401 exploit
- FEDORA-2008-10932 vendor-advisory
- FEDORA-2008-10941 vendor-advisory
- Debian Security Tracker CVE-2008-5660 vendor-advisory