CVE-2019-15690

EUVD-2019-6629
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
KasperskyCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 52.36%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
libvnc_projectlibvncserver
𝑥
≤ 0.9.12
CNA
Debian logo
Debian Releases
Debian Product
Codename
libvncserver
bookworm
0.9.14+dfsg-1
fixed
bullseye
0.9.13+dfsg-2+deb11u1
fixed
sid
0.9.14+dfsg-1
fixed
trixie
0.9.14+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libvncserver
bionic
Fixed 0.9.11+dfsg-1ubuntu1.2
released
eoan
Fixed 0.9.11+dfsg-1.3ubuntu0.1
released
focal
Fixed 0.9.12+dfsg-9ubuntu0.1
released
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
dne
xenial
Fixed 0.9.10+dfsg-3ubuntu0.16.04.4
released
x11vnc
bionic
not-affected
eoan
ignored
focal
not-affected
groovy
ignored
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
ignored
lunar
ignored
mantic
ignored
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
needs-triage
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libvncclient0
suse enterprise desktop 15 SP2
0.9.10-4.14.1
fixed
suse enterprise desktop 15 SP3
0.9.10-4.14.1
fixed
suse enterprise sap 12 SP1
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP2
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP3
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP4
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP5
0.9.9-17.19.1
fixed
suse enterprise sap 15 SP2
0.9.10-4.14.1
fixed
suse enterprise sap 15 SP3
0.9.10-4.14.1
fixed
suse enterprise server 12 SP1
0.9.9-17.19.1
fixed
suse enterprise server 12 SP2
0.9.9-17.19.1
fixed
suse enterprise server 12 SP3
0.9.9-17.19.1
fixed
suse enterprise server 12 SP4
0.9.9-17.19.1
fixed
suse enterprise server 12 SP5
0.9.9-17.19.1
fixed
suse enterprise server 15 SP2
0.9.10-4.14.1
fixed
suse enterprise server 15 SP3
0.9.10-4.14.1
fixed
suse enterprise workstation 15 SP2
0.9.10-4.14.1
fixed
suse enterprise workstation 15 SP3
0.9.10-4.14.1
fixed
libvncclient1
suse enterprise desktop 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise sap 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise server 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise workstation 15 SP4
0.9.13-150400.1.9
fixed
libvncserver0
suse enterprise desktop 15 SP2
0.9.10-4.14.1
fixed
suse enterprise desktop 15 SP3
0.9.10-4.14.1
fixed
suse enterprise sap 12 SP1
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP2
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP3
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP4
0.9.9-17.19.1
fixed
suse enterprise sap 12 SP5
0.9.9-17.19.1
fixed
suse enterprise sap 15 SP2
0.9.10-4.14.1
fixed
suse enterprise sap 15 SP3
0.9.10-4.14.1
fixed
suse enterprise server 12 SP1
0.9.9-17.19.1
fixed
suse enterprise server 12 SP2
0.9.9-17.19.1
fixed
suse enterprise server 12 SP3
0.9.9-17.19.1
fixed
suse enterprise server 12 SP4
0.9.9-17.19.1
fixed
suse enterprise server 12 SP5
0.9.9-17.19.1
fixed
suse enterprise server 15 SP2
0.9.10-4.14.1
fixed
suse enterprise server 15 SP3
0.9.10-4.14.1
fixed
suse enterprise workstation 15 SP2
0.9.10-4.14.1
fixed
suse enterprise workstation 15 SP3
0.9.10-4.14.1
fixed
libvncserver1
suse enterprise desktop 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise sap 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise server 15 SP4
0.9.13-150400.1.9
fixed
suse enterprise workstation 15 SP4
0.9.13-150400.1.9
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libvncserver
RHEL 7
0:0.9.9-14.el7_7
fixed
RHEL 8
0:0.9.11-9.el8_1.2
fixed
RHEL 8.1 E4S
0:0.9.11-9.el8_1.2
fixed
RHEL 8.1 EUS
0:0.9.11-9.el8_1.2
fixed
libvncserver-devel
RHEL 7
0:0.9.9-14.el7_7
fixed
RHEL 8
0:0.9.11-9.el8_1.2
fixed
RHEL 8.1 E4S
0:0.9.11-9.el8_1.2
fixed
RHEL 8.1 EUS
0:0.9.11-9.el8_1.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
libvncserver
Amazon Linux 2
0:0.9.9-14.amzn2
fixed
libvncserver-debuginfo
Amazon Linux 2
0:0.9.9-14.amzn2
fixed
libvncserver-devel
Amazon Linux 2
0:0.9.9-14.amzn2
fixed
Common Weakness Enumeration
References
https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12/