Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-8277

UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.

Published

2019-03-08T23:29:00.967

Last Modified

2024-11-21T04:49:38.077

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-665
  • Type: Primary
    CWE-665
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application uvnc ultravnc < 1.2.2.3 Yes
Application siemens sinumerik_access_mymachine\/p2p < 4.8 Yes
Application siemens sinumerik_pcu_base_win10_software\/ipc < 14.00 Yes
Application siemens sinumerik_pcu_base_win7_software\/ipc ≤ 12.01 Yes
References