Description
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tigervnc | 1.7.0+dfsg-3 | — |
| Debian 13 | tigervnc | 1.7.0+dfsg-3 | — |
| Debian 12 | tigervnc | 1.7.0+dfsg-3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | fltk +3 | 1.3.4-1.el7 | RHSA-2017:2000 |
| RHEL 7 | tigervnc +6 | 1.8.0-1.el7 | RHSA-2017:2000 |
| RHEL 6 | tigervnc +3 | 1.1.0-24.el6 | RHSA-2017:0630 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | fltk +3 | 1.3.4-1.el7 | ELSA-2017-2000 |
| Oracle Linux 7 | tigervnc +6 | 1.8.0-1.el7 | ELSA-2017-2000 |
Advisories 3
- RHSA-2017:2000 Red Hat Security Advisory: tigervnc and fltk security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2017:0630 Red Hat Security Advisory: tigervnc security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2017-2000 Moderate: tigervnc and fltk security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017
References
- [oss-security] 20170121 Re: [tigervnc-announce] TigerVNC 1.7.1 mailing-list
- RHSA-2017:0630 vendor-advisory
- RHSA-2017:2000 vendor-advisory
- GLSA-201702-19 vendor-advisory
- https://github.com/TigerVNC/tigervnc/pull/399
- https://github.com/TigerVNC/tigervnc/commit/18c020124ff1b2441f714da2017f63dba50720ba
- https://github.com/TigerVNC/tigervnc/releases/tag/v1.7.1
- [oss-security] 20170125 Re: [tigervnc-announce] TigerVNC 1.7.1 mailing-list
- 95789 vdb-entry