CVE-2019-15690
CVE-2019-15690
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.
CVSS 8.8 · High · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libvncserver
- Versions
- ≥ *, ≤ 0.9.12: Affected (custom)
No fix published
libvncserver Debian:12
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-9
Update to 0.9.12+dfsg-9
libvncserver Debian:13
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-9
Update to 0.9.12+dfsg-9
libvncserver Debian:14
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-9
Update to 0.9.12+dfsg-9
x11vnc Ubuntu:14.04:LTS
- Versions
- 0.9.13-1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libvncserver Ubuntu:16.04:LTS
- Versions
- 0.9.10+dfsg-3
- 0.9.10+dfsg-3build1
- 0.9.10+dfsg-3ubuntu0.16.04.1
- 0.9.10+dfsg-3ubuntu0.16.04.2
- 0.9.10+dfsg-3ubuntu0.16.04.3
- Affected ranges
- ECOSYSTEM: < 0.9.10+dfsg-3ubuntu0.16.04.4
Update to 0.9.10+dfsg-3ubuntu0.16.04.4
libvncserver Ubuntu:18.04:LTS
- Versions
- 0.9.11+dfsg-1
- 0.9.11+dfsg-1ubuntu1
- 0.9.11+dfsg-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 0.9.11+dfsg-1ubuntu1.2
Update to 0.9.11+dfsg-1ubuntu1.2
libvncserver Ubuntu:20.04:LTS
- Versions
- 0.9.11+dfsg-1.3
- 0.9.12+dfsg-3ubuntu3
- 0.9.12+dfsg-6
- 0.9.12+dfsg-7
- 0.9.12+dfsg-8
- 0.9.12+dfsg-9
- Affected ranges
- ECOSYSTEM: < 0.9.12+dfsg-9ubuntu0.1
Update to 0.9.12+dfsg-9ubuntu0.1