Package name
vinagre
Date
2008-12-10
Advisory ID
MDVSA-2008:240
Affected versions
2009.0 x86_64 , 2009.0 i586 , 2008.1 x86_64 , 2008.1 i586

Problem description

Alfredo Ortega found a flaw in how Vinagre uses format strings.
A remote attacker could exploit this vulnerability if they were able to
trick a user into connecting to a malicious VNC server, or opening a
specially crafted URI with Vinagre. With older versions of Vinagre,
it was possible to execute arbitrary code with user privileges.
In later versions, Vinagre would abort, leading to a denial of service.

The updated packages have been patched to prevent this issue.

Updated packages

2009.0 x86_64

 5e6214867963cc0d8c3776b05212567a  2009.0/x86_64/vinagre-2.24.0-1.1mdv2009.0.x86_64.rpm 
 a22e09709e3c947737a2eefa29983175  2009.0/SRPMS/vinagre-2.24.0-1.1mdv2009.0.src.rpm

2009.0 i586

 b09a10bb652f5d9afa23e076e139d87c  2009.0/i586/vinagre-2.24.0-1.1mdv2009.0.i586.rpm 
 a22e09709e3c947737a2eefa29983175  2009.0/SRPMS/vinagre-2.24.0-1.1mdv2009.0.src.rpm

2008.1 x86_64

 edeeac6c489b5d1f3863f292c030318f  2008.1/x86_64/vinagre-0.5.0-1.1mdv2008.1.x86_64.rpm 
 eb08aeb2f86562c079477bf0c478c546  2008.1/SRPMS/vinagre-0.5.0-1.1mdv2008.1.src.rpm

2008.1 i586

 a8a6ada09391c2e6a84b21e9df02be0a  2008.1/i586/vinagre-0.5.0-1.1mdv2008.1.i586.rpm 
 eb08aeb2f86562c079477bf0c478c546  2008.1/SRPMS/vinagre-0.5.0-1.1mdv2008.1.src.rpm