CVEvulnerability

CVE-2019-15681

7.5 HIGH Published 2019-10-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-665

Description

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

Affected configurations

• libvnc project libvncserver (< 0.9.12) • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 18.10 • debian debian linux 8.0 • debian debian linux 9.0 • siemens simatic itc1500 firmware (>= 3.0.0.0 < 3.2.1.0) • siemens simatic itc1500 pro firmware (>= 3.0.0.0 < 3.2.1.0) • siemens simatic itc1900 firmware (>= 3.0.0.0 < 3.2.1.0) • siemens simatic itc1900 pro firmware (>= 3.0.0.0 < 3.2.1.0) • siemens simatic itc2200 firmware (>= 3.0.0.0 < 3.2.1.0) • siemens simatic itc2200 pro firmware (>= 3.0.0.0 < 3.2.1.0)

Related

Weakness · CWE (1)

  • CWE-665 Improper Initialization weakness

References