CVE-2019-8259
- State
- Published
- Severity
- Not scored
- Published
- Mar 5, 2019
- Updated
- Sep 16, 2024
- Reserved
- Feb 12, 2019
Description
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
Scores
The record has no CVSS score.
Weaknesses
- CWE-665 Improper Initialization
Affected Products
| Product | Versions |
|---|---|
UltraVNCUltraVNC |
|
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-005-ultravnc-memory-leak/
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06
- https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.