A vulnerability has been discovered in Vinagre, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a format string error within the "vinagre_utils_show_error()" function in src/vinagre-utils.c. This can be exploited by e.g. tricking a user into opening a specially crafted .vnc file or connecting to a malicious VNC server.

Successful exploitation may allow the execution of arbitrary code.

The vulnerability is confirmed in version 2.24.0. Other versions may also be affected.

Solution
Update to version 0.5.2 or 2.24.2.
Further details available to Secunia VIM customers

Provided and/or discovered by
Alfredo Ortega, Core Security Technologies

Changelog
Further details available to Secunia VIM customers

Original Advisory
Vinagre:
http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.changes
http://ftp.gnome.org/pub/GNOME/sources/vinagre/2.24/vinagre-2.24.2.changes

Core Security Technologies:
http://www.coresecurity.com/content/vinagre-format-string

Deep Links
Links available to Secunia VIM customers