National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2011-0904 Detail

Description

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.

Source:  MITRE
Description Last Modified:  05/10/2011

Impact

CVSS v2.0 Severity and Metrics:

Base Score: 3.5 LOW
Vector: (AV:N/AC:M/Au:S/C:N/I:N/A:P) (V2 legend)
Impact Subscore: 2.9
Exploitability Subscore: 6.8


Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (AU): Single
Confidentiality (C): None
Integrity (I): None
Availability (A): Partial
Additional Information:
Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://ftp.gnome.org/pub/GNOME/sources/vino/2.28/vino-2.28.3.news
http://ftp.gnome.org/pub/GNOME/sources/vino/2.32/vino-2.32.2.news
http://ftp.gnome.org/pub/GNOME/sources/vino/3.0/vino-3.0.2.news
http://git.gnome.org/browse/vino/commit/?id=0c2c9175963fc56bf2af10e42867181332f96ce0 Patch
http://git.gnome.org/browse/vino/commit/?id=456dadbb5c5971d3448763a44c05b9ad033e522f Patch
http://git.gnome.org/browse/vino/commit/?id=8beefcf7792d343c10c919ee0c928c81f73b1279 Patch
http://git.gnome.org/browse/vino/commit/?id=d050a22b1c284b633c407ef92fde95c47e8fdb8a Patch
http://git.gnome.org/browse/vino/commit/?id=dff52694a384fe95195f2211254026b752d63ec4 Patch
http://git.gnome.org/browse/vino/commit/?id=e17bd4e369f90748654e31a4867211dc7610975d Patch
http://git.gnome.org/browse/vino/log/?h=gnome-2-30 Patch
http://git.gnome.org/browse/vino/tree/NEWS
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://rhn.redhat.com/errata/RHSA-2013-0169.html
http://www.debian.org/security/2011/dsa-2238
http://www.mandriva.com/security/advisories?name=MDVSA-2011:087
http://www.securityfocus.com/bid/47681
http://www.ubuntu.com/usn/usn-1128-1/
http://www.vupen.com/english/advisories/2011/1144 Vendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=641802 Patch
https://bugzilla.redhat.com/show_bug.cgi?id=694455 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/67243

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:a:david_king:vino:2.7:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.3:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.4:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.4.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.4.91:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.7.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.8:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.9:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.9.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.10:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.11:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.12:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.13:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.13.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.14:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.15:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.16:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.17:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.17.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.17.4:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.17.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.17.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.18:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.18.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.19:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.19.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.19.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.19.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.20:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.20.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.3:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.91:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.21.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.22:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.22.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.22.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.23:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.23.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.23.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.23.91:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.23.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.24:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.24.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.3:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.4:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.91:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.25.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.26:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.26.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.26.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.27:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.27.5:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.27.90:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.27.91:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.27.92:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.28:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.28.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.28.2:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.32.0:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:2.32.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:david_king:vino:3.1:*:*:*:*:*:*:*

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2011-0904
NVD Published Date:
05/10/2011
NVD Last Modified:
08/16/2017