Description:
===========================================================Ubuntu Security Notice USN-689-1 December 10, 2008vinagre vulnerabilityhttps://launchpad.net/bugs/305623===========================================================A security issue affects the following Ubuntu releases:Ubuntu 8.04 LTSUbuntu 8.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 8.04 LTS: vinagre 0.5.1-0ubuntu1.1Ubuntu 8.10: vinagre 2.24.1-0ubuntu1.1After a standard system upgrade you need to restart Vinagre to effectthe necessary changes.Details follow:Alfredo Ortega discovered a flaw in Vinagre's use of format strings. Aremote attacker could exploit this vulnerability if they tricked a userinto connecting to a malicious VNC server, or opening a specially craftedURI with Vinagre. In Ubuntu 8.04, it was possible to execute arbitrarycode with user privileges. In Ubuntu 8.10, Vinagre would simply abort,leading to a denial of service.
More...