A vulnerability was found in LibVNC (the affected version unknown). It has been classified as problematic. Affected is an unknown part of the component VNC Server. The manipulation with an unknown input leads to a insufficient psychological acceptability vulnerability. CWE is classifying the issue as CWE-655. The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose. This is going to have an impact on confidentiality. CVE summarizes:

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

The weakness was published 10/29/2019. This vulnerability is traded as CVE-2019-15681 since 08/27/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Applying the patch d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a is able to eliminate this problem.

Similar entries are available at VDB-128119, VDB-130337, VDB-130338 and VDB-130339.

Productinfo

Name

• LibVNC

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion