« Volver al listado

CVE-2019-15695

Estado: ModificadaAlta (7.2)—

TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Opensuse — LeapTigervnc — Tigervnc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15695",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@kaspersky.com",
      "affectedData": [
        {
          "vendor": "Kaspersky",
          "product": "TigerVNC",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-26T16:15:10.793",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vulnerability@kaspersky.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."
    },
    {
      "lang": "es",
      "value": "TigerVNC versión anterior a 1.10.1, es vulnerable al desbordamiento de búfer de pila, que podría ser activada desde la función CMsgReader::readSetCursor. Esta vulnerabilidad se presenta debido al saneamiento insuficiente de PixelFormat. Dado que el atacante remoto puede elegir el desplazamiento desde el arranque del búfer para comenzar a escribir sus valores, la explotación de esta vulnerabilidad podría resultar potencialmente en una ejecución de código remota. Este ataque parece ser explotable a través de la conectividad de red."
    }
  ],
  "lastModified": "2026-06-17T02:20:53.530",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DB31840-DC35-40A5-8126-FF5FDD81EAD7",
              "versionEndExcluding": "1.10.1"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com"
}