UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
References
Configurations
History
21 Nov 2024, 04:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf - | |
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf - Third Party Advisory | |
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf - | |
| References | () https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-005-ultravnc-memory-leak/ - Third Party Advisory | |
| References | () https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 - | |
| References | () https://www.us-cert.gov/ics/advisories/icsa-20-161-06 - Third Party Advisory, US Government Resource |
Information
Published : 2019-03-05 15:29
Updated : 2024-11-21 04:49
NVD link : CVE-2019-8259
Mitre link : CVE-2019-8259
CVE.ORG link : CVE-2019-8259
JSON object : View
Products Affected
siemens
- sinumerik_pcu_base_win7_software\/ipc
- sinumerik_access_mymachine\/p2p
- sinumerik_pcu_base_win10_software\/ipc
uvnc
- ultravnc