CVE-2019-15681

Source
https://nvd.nist.gov/vuln/detail/CVE-2019-15681
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-15681.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-15681
Related
Published
2019-10-29T19:15:18Z
Modified
2024-10-12T04:27:48.248923Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

References

Affected packages

Alpine:v3.10 / libvncserver

Package

Name
libvncserver
Purl
pkg:apk/alpine/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.11-r3

Affected versions

0.*

0.9.10-r0
0.9.10-r1
0.9.11-r0
0.9.11-r1
0.9.11-r2

Alpine:v3.11 / libvncserver

Package

Name
libvncserver
Purl
pkg:apk/alpine/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.12-r1

Affected versions

0.*

0.9.10-r0
0.9.10-r1
0.9.11-r0
0.9.11-r1
0.9.11-r2
0.9.12-r0

Alpine:v3.7 / libvncserver

Package

Name
libvncserver
Purl
pkg:apk/alpine/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.11-r3

Affected versions

0.*

0.9.10-r0
0.9.10-r1
0.9.11-r0
0.9.11-r1
0.9.11-r2

Alpine:v3.8 / libvncserver

Package

Name
libvncserver
Purl
pkg:apk/alpine/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.11-r3

Affected versions

0.*

0.9.10-r0
0.9.10-r1
0.9.11-r0
0.9.11-r1
0.9.11-r2

Alpine:v3.9 / libvncserver

Package

Name
libvncserver
Purl
pkg:apk/alpine/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.11-r3

Affected versions

0.*

0.9.10-r0
0.9.10-r1
0.9.11-r0
0.9.11-r1
0.9.11-r2

Debian:11 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.12+dfsg-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.12+dfsg-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.12+dfsg-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:11 / tightvnc

Package

Name
tightvnc
Purl
pkg:deb/debian/tightvnc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.9-9.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / tightvnc

Package

Name
tightvnc
Purl
pkg:deb/debian/tightvnc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.9-9.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / tightvnc

Package

Name
tightvnc
Purl
pkg:deb/debian/tightvnc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.9-9.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / vino

Package

Name
vino
Purl
pkg:deb/debian/vino?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.22.0-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / vino

Package

Name
vino
Purl
pkg:deb/debian/vino?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.22.0-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / vino

Package

Name
vino
Purl
pkg:deb/debian/vino?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.22.0-6

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/libvnc/libvncserver

Affected ranges

Type
GIT
Repo
https://github.com/libvnc/libvncserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

LibVNCServer-0.*

LibVNCServer-0.9.10
LibVNCServer-0.9.11
LibVNCServer-0.9.12
LibVNCServer-0.9.8
LibVNCServer-0.9.9

Other

X11VNC_0_9_10
X11VNC_0_9_11
X11VNC_0_9_12
X11VNC_0_9_7
X11VNC_0_9_8
X11VNC_0_9_9
X11VNC_REL_0_9_4
X11VNC_REL_0_9_5
X11VNC_REL_0_9_6