huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2010-4527: kernel: buffer overflow in OSS load_mixer_volumes
Component: kernel
Severity: Important
Public date: 2010-12-29T00:00:00+00:00

The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.

Statement: Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6 and Red Hat Enterprise MRG as they did not provide support for Open Sound System (OSS).

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d81a12bc29ae4038770e05dce4ab7f26fd5880fb
CVE-2010-4648: kernel: orinoco: fix TKIP countermeasure behaviour
Component: kernel
Severity: Low
Public date: 2010-12-08T00:00:00+00:00

The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they did not backport the upstream commit d03032af that introduced this issue. Future kernel updates in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 0a54917c3fc295cb61f3fb52373c173fd3b69f48
CVE-2010-4649: kernel: IB/uverbs: Handle large number of entries in poll CQ
Component: kernel
Severity: Important
Public date: 2010-12-08T00:00:00+00:00

Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7182afea8d1afd432a17c18162cc3fd441d0da93
CVE-2010-4655: kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl
Component: kernel
Severity: Low
Public date: 2010-10-11T00:00:00+00:00

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b00916b189d13a615ff05c9242201135992fcda3
CVE-2010-4656: kernel: iowarrior usb device heap overflow
Component: kernel
Severity: Moderate
Public date: 2010-10-22T00:00:00+00:00

The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they do not have support for the I/O-Warrior USB devices. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3ed780117dbe5acb64280d218f0347f238dafed0
CVE-2010-4668: kernel: panic when submitting certain 0-length I/O requests
Component: kernel
Severity: Moderate
Public date: 2010-11-10T00:00:00+00:00

The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.37-rc7 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device, related to an unaligned map.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4163.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they did not backport the upstream commit c5dec1c3
that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 5478755616ae2ef1ce144dded589b62b2a50d575
CVE-2010-4805: kernel: unlimited socket backlog DoS
Component: kernel
Severity: Moderate
Public date: 2010-11-25T00:00:00+00:00

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG as they have already backported the fixes for this issue. Future kernel updates in Red Hat Enterprise Linux 6 may address this flaw. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.35
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c377411f2494a931ff7facdbb3a6839b1266bcf6
CVE-2010-4818: X.org: multiple GLX input sanitization flaws
Component: X.org
Severity: Moderate
Public date: 2011-09-21T00:00:00+00:00

The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.


Affected upstream versions: n/a
Fixed upstream versions: xorg-server-1.9.99.902
Upstream repository: https://cgit.freedesktop.org/xorg/xserver
Upstream fix commit: 3f0d3f4d97bce75c1828635c322b6560a45a037f
CVE-2010-4819: X.org: ProcRenderAddGlyphs input sanitization flaw
Component: X.org
Severity: Moderate
Public date: 2010-08-22T00:00:00+00:00

The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw."


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/xorg/xserver/commit/render/render.c
Upstream fix commit: 5725849a1b427cd4a72b84e57f211edb35838718
CVE-2010-5076: Qt: QSslSocket incorrect handling of IP wildcards in certificate Common Name
Component: Qt
Severity: Low
Public date: 2010-07-14T00:00:00+00:00

QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


Affected upstream versions: n/a
Upstream repository: https://qt.gitorious.org/qt/qt
Upstream fix commit: 846f1b44eea4bb34d080d055badb40a4a13d369e
CVE-2010-5312: jquery-ui: XSS vulnerability in jQuery.ui.dialog title option
Component: jquery-ui
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2010-09-03T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.


Affected upstream versions: n/a
Fixed upstream versions: 1.10.0
Upstream repository: https://github.com/jquery/jquery-ui
Upstream fix commit: 7e9060c109b928769a664dbcc2c17bd21231b6f3
CVE-2010-5313: kernel: kvm: reporting emulation failures to userspace
Component: kernel
Severity: Moderate
Public date: 2014-09-24T00:00:00+00:00

It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.

Statement: This issue did not affect the kvm packages as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: fc3a9157d3148ab91039c75423da8ef97be3e105
CVE-2011-0006: kernel: ima: fix add LSM rule bug
Component: kernel
Severity: Low
Public date: 2011-01-04T00:00:00+00:00

The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG are not affected by this issue. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 867c20265459d30a01b021a9c1e81fb4c5832aa9
CVE-2011-0010: sudo: does not ask for password on GID changes
Component: sudo
Severity: Low
Public date: 2011-01-11T00:00:00+00:00

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.


Affected upstream versions: n/a
Upstream repository: https://www.sudo.ws/repos/sudo
Upstream fix commit: 07d1b0ce530e
CVE-2011-0064: pango: missing memory reallocation failure checking in hb_buffer_ensure
Component: pango
Severity: Critical
Public date: 2011-03-01T00:00:00+00:00

The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.

Statement: This issue did not affect the versions of qt shipped with Red Hat Enterprise Linux 4, 5 and 6.

Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/harfbuzz
Upstream fix commit: a6a79df5fe2ed2cd307e7a991346faee164e70d9
CVE-2011-0465: xorg: xrdb code execution via crafted X client hostname
Component: xorg
Severity: Moderate
Public date: 2011-04-05T00:00:00+00:00

xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.


Affected upstream versions: n/a
Fixed upstream versions: xrdb-1.0.9
Upstream repository: https://cgit.freedesktop.org/xorg/app/xrdb
Upstream fix commit: 1027d5df07398c1507fb1fe3a9981aa6b4bc3a56
CVE-2011-0521: kernel: av7110 negative array offset
Component: kernel
Severity: Important
Public date: 2011-01-19T00:00:00+00:00

The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for ULE (Unidirectional Lightweight Encapsulation). We have included a fix for this issue in Red Hat Enterprise Linux 4, 5 and Red Hat Enterprise MRG however the affected module is not build by default.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: cb26a24ee9706473f31d34cc259f4dcf45cd0644
CVE-2011-0536: glibc: fix causes linker to search CWD when running privileged program with $ORIGIN in R*PATH
Component: glibc
Severity: Important
CWE: CWE-426 (Untrusted Search Path)
Public date: 2011-01-11T00:00:00+00:00

Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 96611391ad8823ba58405325d78cefeae5cdf699
CVE-2011-0541: fuse: unprivileged user can unmount arbitrary locations via symlink attack
Component: fuse
Severity: Low
Public date: 2010-11-02T00:00:00+00:00

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact.  On Red Hat Enterprise Linux 5 and 6, a user must be a member of the 'fuse' group in order to use FUSE.  Due to the risks associated with fixing this bug on Red Hat Enterprise Linux 5, and because of the group restrictions in place,  we currently have no plans to fix this flaw in Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Upstream repository: https://fuse.git.sourceforge.net/git/fuse/fuse
Upstream fix commit: bf5ffb5fd8558bd799791834def431c0cee5a11f
CVE-2011-0542: fuse: unprivileged user can unmount arbitrary locations via symlink attack
Component: fuse
Severity: Low
Public date: 2010-11-02T00:00:00+00:00

fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact.  On Red Hat Enterprise Linux 5 and 6, a user must be a member of the 'fuse' group in order to use FUSE.  Due to the risks associated with fixing this bug on Red Hat Enterprise Linux 5, and because of the group restrictions in place,  we currently have no plans to fix this flaw in Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Upstream repository: https://fuse.git.sourceforge.net/git/fuse/fuse
Upstream fix commit: 1e7607ff89c65b005f69e27aeb1649d624099873
CVE-2011-0543: fuse: unprivileged user can unmount arbitrary locations via symlink attack
Component: fuse
Severity: Low
Public date: 2010-11-02T00:00:00+00:00

Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact.  On Red Hat Enterprise Linux 5 and 6, a user must be a member of the 'fuse' group in order to use FUSE.  Due to the risks associated with fixing this bug on Red Hat Enterprise Linux 5, and because of the group restrictions in place,  we currently have no plans to fix this flaw in Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Upstream repository: https://fuse.git.sourceforge.net/git/fuse/fuse
Upstream fix commit: cbd3a2a84068aae6e3fe32939d88470d712dbf47
CVE-2011-0710: kernel: s390 task_show_regs infoleak
Component: kernel
Severity: Low
Public date: 2011-02-15T00:00:00+00:00

The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG as it does not have support for the S390 architecture. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle,
https://access.redhat.com/support/policy/updates/errata/, therefore the fix for
this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-0429.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 261cd298a8c363d7985e3482946edb4bfedacf98
CVE-2011-0711: kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1
Component: kernel
Severity: Low
Public date: 2011-02-10T00:00:00+00:00

The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not have support for the XFS file system. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise
MRG via https://rhn.redhat.com/errata/RHSA-2011-0927.html, https://rhn.redhat.com/errata/RHSA-2011-0498.html, and https://rhn.redhat.com/errata/RHSA-2011-0500.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba
CVE-2011-0712: kernel: ALSA: caiaq - Fix possible string-buffer overflow
Component: kernel
Severity: Low
Public date: 2011-02-14T00:00:00+00:00

Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the driver for Native Instruments USB audio devices. It did not affect the Linux kernel as shipped with Red Hat Enterprise MRG as it did not enable support for this driver. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-0498.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/tiwai/sound-2.6.git
Upstream fix commit: eaae55dac6b64c0616046436b294e69fc5311581
CVE-2011-0716: kernel: deficiency in processing igmp host membership reports in br_multicast
Component: kernel
Severity: Moderate
Public date: 2010-12-02T00:00:00+00:00

The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG as they did not include
support for the bridge snooping functionality. A future update in Red Hat
Enterprise Linux 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 6b0d6a9b4296fa16a28d10d416db7a770fc03287
CVE-2011-0726: kernel: proc: protect mm start_code/end_code in /proc/pid/stat
Component: kernel
Severity: Low
Public date: 2011-03-11T00:00:00+00:00

The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.

Statement: Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle,
https://access.redhat.com/support/policy/updates/errata/, therefore the fix for
this issue is not currently planned to be included in the future updates. Future kernel updates in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 5883f57ca0008ffc93e09cbb9847a1928e50c6f3
CVE-2011-0904: vino: Out of bounds read flaw by processing certain client raw encoding framebuffer update requests
Component: vino
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2011-05-02T00:00:00+00:00

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.


Affected upstream versions: n/a
Upstream repository: https://git.gnome.org/browse/vino
Upstream fix commit: 0c2c9175963fc56bf2af10e42867181332f96ce0
CVE-2011-0905: vino: Out of bounds read flaw by processing certain client tight encoding framebuffer update requests
Component: vino
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2011-05-02T00:00:00+00:00

The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation.


Affected upstream versions: n/a
Upstream repository: https://git.gnome.org/browse/vino
Upstream fix commit: 0c2c9175963fc56bf2af10e42867181332f96ce0