7.5

CVE-2019-15681

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libvnc Project ≫ Libvncserver Version < 0.9.12
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.10
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Siemens ≫ Simatic Itc1500 Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc1500 Version -
Siemens ≫ Simatic Itc1500 Pro Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc1500 Pro Version -
Siemens ≫ Simatic Itc1900 Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc1900 Version -
Siemens ≫ Simatic Itc1900 Pro Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc1900 Pro Version -
Siemens ≫ Simatic Itc2200 Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc2200 Version -
Siemens ≫ Simatic Itc2200 Pro Firmware Version >= 3.0.0.0 < 3.2.1.0
   Siemens ≫ Simatic Itc2200 Pro Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.91% 0.855
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4587-1/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4573-1/
Third Party Advisory
https://usn.ubuntu.com/4547-1/
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
Third Party Advisory
https://usn.ubuntu.com/4407-1/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html
Third Party Advisory
Mailing List
https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00039.html
Third Party Advisory
Mailing List