CVE Vulnerabilities

CVE-2017-7393

Double Free

Published: Apr 01, 2017 | Modified: Nov 21, 2024
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.

Weakness

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Affected Software

Name Vendor Start Version End Version
Tigervnc Tigervnc 1.7.1 (including) 1.7.1 (including)
Tigervnc Ubuntu artful *
Tigervnc Ubuntu upstream *
Tigervnc Ubuntu zesty *
Red Hat Enterprise Linux 7 RedHat fltk-0:1.3.4-1.el7 *
Red Hat Enterprise Linux 7 RedHat tigervnc-0:1.8.0-1.el7 *

Potential Mitigations

References