PT-2019-5779 · Virtualgl · Turbovnc

Published 2019-10-29 · Updated 2019-11-05 · CVE-2019-15683

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TurboVNC versions prior to the version containing commit cea98166008301e614e0d36776bf9435a536136e

Description The issue is related to a stack buffer overflow vulnerability in the TurboVNC server code. This could result in remote code execution since the stack frame is not protected with a stack canary. The attack appears to be exploitable via network connectivity and requires authorization on the server.

Recommendations For TurboVNC versions prior to the version containing commit cea98166008301e614e0d36776bf9435a536136e, update to a version that includes the fix for this issue.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2021-02125

CVE-2019-15683

Affected Products

Turbovnc

References · 5

• https://github.com/TurboVNC/turbovnc/commit/cea98166008301e614e0d36776bf9435a536136e · Patch
• https://osv.dev/vulnerability/CVE-2019-15683 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02125 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-15683 · Security Note
• https://safe.cnews.ru/news/line/2019-11-14_laboratoriya_kasperskogo · Note