CVE-2017-3158

NameCVE-2017-3158
DescriptionA race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs891798

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
guacamole-client (PTS)jessie0.8.3-1.1vulnerable
sid, stretch0.9.9+dfsg-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
guacamolesource(unstable)(unfixed)medium
guacamolesourcewheezy(not affected)
guacamole-clientsource(unstable)(unfixed)medium891798

Notes

[stretch] - guacamole-client <no-dsa> (Minor issue)
[jessie] - guacamole-client <no-dsa> (Minor issue)
[wheezy] - guacamole <not-affected> (Version not vulnerable)

Search for package or bug name: Reporting problems