CVE-2019-15691

{"id": "CVE-2019-15691", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-12-26T15:15:11.007", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html", "tags": ["Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40", "tags": ["Patch", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1", "tags": ["Release Notes", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://www.openwall.com/lists/oss-security/2019/12/20/2", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.openwall.com/lists/oss-security/2019/12/20/2", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "vulnerability@kaspersky.com", "description": [{"lang": "en", "value": "CWE-825"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity."}, {"lang": "es", "value": "TigerVNC versiones anteriores a 1.10.1, es vulnerable al uso de la pila previo al retorno, que se presenta debido a un uso incorrecto de la memoria de pila en ZRLEDecoder. Si la rutina de decodificaci\u00f3n arroja una excepci\u00f3n, ZRLEDecoder puede intentar acceder a la variable de la pila, que ya ha sido liberada durante el proceso del desempaquetado de la pila. La explotaci\u00f3n de esta vulnerabilidad podr\u00eda resultar potencialmente en una ejecuci\u00f3n de c\u00f3digo remota. Este ataque parece ser explotable a trav\u00e9s de la conectividad de red."}], "lastModified": "2024-11-21T04:29:16.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DB31840-DC35-40A5-8126-FF5FDD81EAD7", "versionEndExcluding": "1.10.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@kaspersky.com"}