CVE-2019-15679 Memory corruption in TightVNC
A heap buffer overflow in TightVNC allows remote attackers to execute arbitrary code via network connectivity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15679?
CVE-2019-15679 is a critical memory corruption vulnerability in Kaspersky TightVNC, published on 29 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
Which versions are affected by CVE-2019-15679?
It affects 1 product.
Products include Tightvnc Tightvnc.
How do I fix CVE-2019-15679?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-15679 being exploited?
There is no known exploitation of CVE-2019-15679 in the wild and no public exploit code.
Other vulnerabilities in Kaspersky TightVNC
Sources
Also known as CVE-2022-23967, DEBIAN-CVE-2019-15679, GHSA-w238-gwcm-c55r, UBUNTU-CVE-2019-15679.