CVE-2011-0904

CVSS V2 Low 3.5 CVSS V3 None
Description
The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.
Overview
  • CVE ID
  • CVE-2011-0904
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2011-05-10T18:55:01
  • Last Modified Date
  • 2017-08-17T01:33:45
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:david_king:vino:2.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.4.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.4.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.7.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.9.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.13.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.17.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.17.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.17.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.17.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.18.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.19.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.19.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.19.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.20.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.21.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.22.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.22.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.23:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.23.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.23.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.23.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.23.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.24:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.24.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.25.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.26:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.26.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.26.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.27:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.27.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.27.90:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.27.91:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.27.92:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.28:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.28.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.28.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.32.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:2.32.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:3.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:3.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:david_king:vino:3.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:S/C:N/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 3.5
  • Severity
  • LOW
  • Exploitability Score
  • 6.8
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.vupen.com/english/advisories/2011/1144 Vendor Advisory
http://git.gnome.org/browse/vino/commit/?id=456dadbb5c5971d3448763a44c05b9ad033e522f Patch
http://secunia.com/advisories/44463 Vendor Advisory
http://git.gnome.org/browse/vino/commit/?id=0c2c9175963fc56bf2af10e42867181332f96ce0 Patch
http://ftp.gnome.org/pub/GNOME/sources/vino/2.28/vino-2.28.3.news
http://git.gnome.org/browse/vino/commit/?id=dff52694a384fe95195f2211254026b752d63ec4 Patch
http://git.gnome.org/browse/vino/commit/?id=e17bd4e369f90748654e31a4867211dc7610975d Patch
https://bugzilla.redhat.com/show_bug.cgi?id=694455 Patch
http://ftp.gnome.org/pub/GNOME/sources/vino/2.32/vino-2.32.2.news
http://git.gnome.org/browse/vino/log/?h=gnome-2-30 Patch
https://bugzilla.gnome.org/show_bug.cgi?id=641802 Patch
http://www.ubuntu.com/usn/usn-1128-1/
http://git.gnome.org/browse/vino/tree/NEWS
http://secunia.com/advisories/44410 Vendor Advisory
http://git.gnome.org/browse/vino/commit/?id=8beefcf7792d343c10c919ee0c928c81f73b1279 Patch
http://ftp.gnome.org/pub/GNOME/sources/vino/3.0/vino-3.0.2.news
http://www.securityfocus.com/bid/47681
http://git.gnome.org/browse/vino/commit/?id=d050a22b1c284b633c407ef92fde95c47e8fdb8a Patch
http://www.debian.org/security/2011/dsa-2238
http://www.mandriva.com/security/advisories?name=MDVSA-2011:087
http://rhn.redhat.com/errata/RHSA-2013-0169.html
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/67243
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2011-0904
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0904
History
Created Old Value New Value Data Type Notes
2022-05-10 08:55:10 Added to TrackCVE