PT-2019-5419 · Libvncserver Team+5 · Libvncserver+5
Pavel Cheremushkin
·
Publicado
2019-08-30
·
Atualizado
2024-06-15
·
CVE-2019-15681
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
LibVNCServer versions prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
Description
The issue is related to a memory leak in the VNC server code, which can be exploited by an attacker to read stack memory and disclose information. This can be combined with another vulnerability to bypass ASLR. The attack is exploitable via network connectivity.
Recommendations
For versions prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a, update to a version that includes the fix from commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.
Correção
Improper Initialization
Missing Release of Resource after Effective Lifetime
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Libvncserver
Linuxmint
Suse
Ubuntu