CVE-2019-8261

EUVD-2019-17659
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
uvncultravnc
𝑥
< 1.2.2.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-007-ultravnc-out-of-bound-read/
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
https://www.us-cert.gov/ics/advisories/icsa-20-161-06
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-007-ultravnc-out-of-bound-read/
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
https://www.us-cert.gov/ics/advisories/icsa-20-161-06