p PatchFirst

CVE-2019-15691

CVE-2019-15691

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

CVSS 7.2 · High · EPSS 4.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • tigervnc

    Versions
    • 1.10.0: Affected

    No fix published

  • tigervnc Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.10.1+dfsg-1

    Update to 1.10.1+dfsg-1

  • tigervnc Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.10.1+dfsg-1

    Update to 1.10.1+dfsg-1

  • tigervnc Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.10.1+dfsg-1

    Update to 1.10.1+dfsg-1

  • tigervnc Ubuntu:18.04:LTS

    Versions
    • 1.7.0+dfsg-7ubuntu1
    • 1.7.0+dfsg-8ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →