CVE-2019-15681
- State
- Published
- Severity
- Not scored
- Published
- Oct 29, 2019
- Updated
- Aug 5, 2024
- Reserved
- Aug 27, 2019
Description
LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.
Scores
The record has no CVSS score.
Weaknesses
- CWE-665 Improper Initialization
Affected Products
| Product | Versions |
|---|---|
LibVNCKaspersky |
|
References
- https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
- [debian-lts-announce] 20191030 [SECURITY] [DLA 1977-1] libvncserver security updatemailing-list
- [debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security updatemailing-list
- [debian-lts-announce] 20191129 [SECURITY] [DLA 2014-1] vino security updatemailing-list
- [debian-lts-announce] 20191221 [SECURITY] [DLA 2045-1] tightvnc security updatemailing-list
- openSUSE-SU-2020:0624vendor-advisory
- USN-4407-1vendor-advisory
- openSUSE-SU-2020:1071vendor-advisory
- USN-4547-1vendor-advisory
- USN-4573-1vendor-advisory
- USN-4587-1vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.