CVEvulnerability
CVE-2019-8260
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-03-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-125
Description
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.
Affected configurations
• uvnc ultravnc (< 1.2.2.3)
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf cert-portal.siemens.com
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-006-ultravnc-out-of-bound-read/ Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 us-cert.cisa.gov
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06 www.us-cert.gov
- https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf cert-portal.siemens.com
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-006-ultravnc-out-of-bound-read/ Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 us-cert.cisa.gov
- https://www.us-cert.gov/ics/advisories/icsa-20-161-06 www.us-cert.gov