← Back to CVEs
CVE-2019-15691
HIGH7.2
Description
TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVE Details
CVSS v3.1 Score7.2
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
Published12/26/2019
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
opensuse:leaptigervnc:tigervnc
Weaknesses (CWE)
CWE-825CWE-672
References
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html(vulnerability@kaspersky.com)
https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40(vulnerability@kaspersky.com)
https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1(vulnerability@kaspersky.com)
https://www.openwall.com/lists/oss-security/2019/12/20/2(vulnerability@kaspersky.com)
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1(af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2019/12/20/2(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.