CVE-2008-5660

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-12-17 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.

Affected products

GNOME Vinagre: 0.5.0, 0.5.1, 2.23.1, 2.23.2, 2.23.3, 2.23.3.1 (+6)

References

http://secunia.com/advisories/33041
http://secunia.com/advisories/33046
http://secunia.com/advisories/33082
http://www.coresecurity.com/content/vinagre-format-string
http://www.mandriva.com/security/advisories?name=MDVSA-2008:240
http://www.securityfocus.com/archive/1/499057/100/0/threaded
http://www.ubuntu.com/usn/usn-689-1
http://www.vupen.com/english/advisories/2008/3362
https://bugzilla.redhat.com/show_bug.cgi?id=475070
https://www.exploit-db.com/exploits/7401
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00473.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00485.html

Get alerted when CVE-2008-5660 or the next vulnerability affects your stack