Bug 636396 (CVE-2016-10207)

Summary:	<net-misc/tigervnc-1.8.0: Denial of service vulnerability (CVE-2016-10207)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	otakuto.gentoo, proxy-maint
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/TigerVNC/tigervnc/commit/8aa4bc53206c2430bbf0c8f4b642f59a379ee649
Whiteboard:	B3 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	634788
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2017-11-03 15:47:44 UTC

CVE-2016-10207 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10207):
  The Xvnc server in TigerVNC allows remote attackers to cause a denial of
  service (invalid memory access and crash) by terminating a TLS handshake
  early.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-11-03 15:50:56 UTC

@Maintainers fix is available in 1.8.0

Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-11-24 22:31:04 UTC

Added to existing GLSA.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2018-01-11 23:00:44 UTC

This issue was resolved and addressed in
 GLSA 201801-13 at https://security.gentoo.org/glsa/201801-13
by GLSA coordinator Thomas Deutschmann (whissi).