CVEvulnerability

CVE-2019-8259

7.5 HIGH Published 2019-03-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-401, CWE-665

Description

UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.

Affected configurations

• uvnc ultravnc (< 1.2.2.3) • siemens sinumerik access mymachine\/p2p (< 4.8) • siemens sinumerik pcu base win10 software\/ipc (< 14.00) • siemens sinumerik pcu base win7 software\/ipc (<= 12.01)

Related

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-665 Improper Initialization weakness

References