{"containers": {"cna": {"affected": [{"product": "TigerVNC", "vendor": "Kaspersky", "versions": [{"status": "affected", "version": "1.10.0"}]}], "descriptions": [{"lang": "en", "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-01-21T21:06:14", "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "shortName": "Kaspersky"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"}, {"name": "[oss-security] 20191220 VNC vulnerabilities. TigerVNC security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89"}, {"name": "openSUSE-SU-2020:0087", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2019-15695", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TigerVNC", "version": {"version_data": [{"version_value": "1.10.0"}]}}]}, "vendor_name": "Kaspersky"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-121: Stack-based Buffer Overflow"}]}]}, "references": {"reference_data": [{"name": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1", "refsource": "MISC", "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"}, {"name": "[oss-security] 20191220 VNC vulnerabilities. TigerVNC security update", "refsource": "MLIST", "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2"}, {"name": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89", "refsource": "MISC", "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89"}, {"name": "openSUSE-SU-2020:0087", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T00:56:22.455Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"}, {"name": "[oss-security] 20191220 VNC vulnerabilities. TigerVNC security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89"}, {"name": "openSUSE-SU-2020:0087", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"}]}]}, "cveMetadata": {"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "assignerShortName": "Kaspersky", "cveId": "CVE-2019-15695", "datePublished": "2019-12-26T15:24:00", "dateReserved": "2019-08-27T00:00:00", "dateUpdated": "2024-08-05T00:56:22.455Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DB31840-DC35-40A5-8126-FF5FDD81EAD7", "versionEndExcluding": "1.10.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."}, {"lang": "es", "value": "TigerVNC versi\u00f3n anterior a 1.10.1, es vulnerable al desbordamiento de b\u00fafer de pila, que podr\u00eda ser activada desde la funci\u00f3n CMsgReader::readSetCursor. Esta vulnerabilidad se presenta debido al saneamiento insuficiente de PixelFormat. Dado que el atacante remoto puede elegir el desplazamiento desde el arranque del b\u00fafer para comenzar a escribir sus valores, la explotaci\u00f3n de esta vulnerabilidad podr\u00eda resultar potencialmente en una ejecuci\u00f3n de c\u00f3digo remota. Este ataque parece ser explotable a trav\u00e9s de la conectividad de red."}], "id": "CVE-2019-15695", "lastModified": "2024-11-21T04:29:16.647", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-12-26T16:15:10.793", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"}, {"source": "[email protected]", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2019/12/20/2"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2020:3875", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "tigervnc-0:1.8.0-21.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2020-09-29T00:00:00Z"}, {"advisory": "RHSA-2020:1497", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "tigervnc-0:1.9.0-14.el8_1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-04-16T00:00:00Z"}], "bugzilla": {"description": "tigervnc: Stack buffer overflow in CMsgReader::readSetCursor", "id": "1790318", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790318"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-121", "details": ["TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."], "name": "CVE-2019-15695", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "tigervnc", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2019-12-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-15695\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-15695"], "threat_severity": "Moderate", "upstream_fix": "tigervnc 1.10.1"}