Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-15681

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

Published

2019-10-29T19:15:18.127

Last Modified

2024-11-21T04:29:15.050

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-665
  • Type: Primary
    CWE-665
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application libvnc_project libvncserver < 0.9.12 Yes
Operating System canonical ubuntu_linux 14.04 Yes
Operating System canonical ubuntu_linux 16.04 Yes
Operating System canonical ubuntu_linux 16.04 Yes
Operating System canonical ubuntu_linux 18.04 Yes
Operating System canonical ubuntu_linux 18.10 Yes
Operating System debian debian_linux 8.0 Yes
Operating System debian debian_linux 9.0 Yes
Operating System siemens simatic_itc1500_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc1500 - No
Operating System siemens simatic_itc1500_pro_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc1500_pro - No
Operating System siemens simatic_itc1900_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc1900 - No
Operating System siemens simatic_itc1900_pro_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc1900_pro - No
Operating System siemens simatic_itc2200_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc2200 - No
Operating System siemens simatic_itc2200_pro_firmware < 3.2.1.0 Yes
Hardware siemens simatic_itc2200_pro - No
References