QwikSec

Security Database

CVE

CWE

Training

CVE-2019-15681

Published: Oct 29, 2019

Modified: Aug 5, 2024

PUBLISHED

Description

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

Vendor	Product	Versions
Kaspersky	LibVNC	affected `0.9.12`

Weaknesses (CWE)

References

https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a

x_refsource_MISC

[debian-lts-announce] 20191030 [SECURITY] [DLA 1977-1] libvncserver security update

mailing-list

x_refsource_MLIST

[debian-lts-announce] 20191030 [SECURITY] [DLA 1979-1] italc security update

mailing-list

x_refsource_MLIST

[debian-lts-announce] 20191129 [SECURITY] [DLA 2014-1] vino security update

mailing-list

x_refsource_MLIST

[debian-lts-announce] 20191221 [SECURITY] [DLA 2045-1] tightvnc security update

mailing-list

x_refsource_MLIST

openSUSE-SU-2020:0624

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_UBUNTU

openSUSE-SU-2020:1071

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_UBUNTU

vendor-advisory

x_refsource_UBUNTU

vendor-advisory

x_refsource_UBUNTU

https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.