CVE-2019-15695
Summary
| CVE | CVE-2019-15695 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-12-26 16:15:00 UTC |
| Updated | 2020-10-16 20:00:00 UTC |
| Description | TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. |
Risk And Classification
Problem Types: CWE-787 | CWE-754
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Handle pixel formats with odd shift values · CendioOssman/tigervnc@05e2849 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| [security-announce] openSUSE-SU-2020:0087-1: important: Security update | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Release TigerVNC 1.10.1 · TigerVNC/tigervnc · GitHub | MISC | github.com | Patch, Third Party Advisory |
| oss-security - VNC vulnerabilities. TigerVNC security update | MLIST | www.openwall.com | Exploit, Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.