← Volver a CVEs

CVE-2019-15691

HIGH

7.2

Descripcion

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Detalles CVE

Puntuacion CVSS v3.17.2

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado12/26/2019

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

opensuse:leaptigervnc:tigervnc

Debilidades (CWE)

CWE-825CWE-672

Referencias

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html(vulnerability@kaspersky.com)

https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40(vulnerability@kaspersky.com)

https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1(vulnerability@kaspersky.com)

https://www.openwall.com/lists/oss-security/2019/12/20/2(vulnerability@kaspersky.com)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1(af854a3a-2127-422b-91ae-364da2661108)

https://www.openwall.com/lists/oss-security/2019/12/20/2(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.