CVE-2019-15691

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html	Third Party Advisory
https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40	Patch Third Party Advisory
https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1	Release Notes Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/12/20/2	Exploit Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-12-26 15:15

Updated : 2022-11-09 21:25

NVD link : CVE-2019-15691

Mitre link : CVE-2019-15691

CVE.ORG link : CVE-2019-15691

JSON object : View

Products Affected

tigervnc

tigervnc

opensuse

leap

CWE

CWE-672

Operation on a Resource after Expiration or Release

CWE-825

Expired Pointer Dereference

{"id": "CVE-2019-15691", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-12-26T15:15:11.007", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html", "tags": ["Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40", "tags": ["Patch", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1", "tags": ["Release Notes", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://www.openwall.com/lists/oss-security/2019/12/20/2", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-672"}]}, {"type": "Secondary", "source": "vulnerability@kaspersky.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."}, {"lang": "es", "value": "TigerVNC versiones anteriores a 1.10.1, es vulnerable al uso de la pila previo al retorno, que se presenta debido a un uso incorrecto de la memoria de pila en ZRLEDecoder. Si la rutina de decodificaci\u00f3n arroja una excepci\u00f3n, ZRLEDecoder puede intentar acceder a la variable de la pila, que ya ha sido liberada durante el proceso del desempaquetado de la pila. La explotaci\u00f3n de esta vulnerabilidad podr\u00eda resultar potencialmente en una ejecuci\u00f3n de c\u00f3digo remota. Este ataque parece ser explotable a trav\u00e9s de la conectividad de red."}], "lastModified": "2022-11-09T21:25:17.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DB31840-DC35-40A5-8126-FF5FDD81EAD7", "versionEndExcluding": "1.10.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@kaspersky.com"}

7.2 /10