High severity · published Apr 1, 2017
CVE-2017-7396
In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server
7.5
CVSS
2%
EPSS
No
On KEV
Description
In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
Tigervnc · Tigervnc
1.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7396
www.securityfocus.com
http://www.securityfocus.com/bid/97305
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:2000
Issue Tracking
https://github.com/TigerVNC/tigervnc/pull/436
Issue Tracking
https://github.com/TigerVNC/tigervnc/pull/436/commits/dccb5f7d776e93863ae10bbff56a45c523c6eeb0
security.gentoo.org
https://security.gentoo.org/glsa/201801-13
More from Tigervnc
9.8
CVE-2026-34352
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect…
9.8
CVE-2014-0011
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a…
9.8
CVE-2017-5581
Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle…
9.8
CVE-2014-8241
XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to…
8.8
CVE-2017-7393
In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution