CVE-2019-15693 Memory corruption in TigerVNC
A heap buffer overflow in TigerVNC allows remote attackers to execute arbitrary code via network connectivity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15693?
CVE-2019-15693 is a high-severity memory corruption vulnerability in Kaspersky TigerVNC, published on 26 Dec 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
Which versions are affected by CVE-2019-15693?
It affects 1 product.
Products include Tigervnc Tigervnc.
How do I fix CVE-2019-15693?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-15693 being exploited?
There is no known exploitation of CVE-2019-15693 in the wild and no public exploit code.
Other vulnerabilities in Kaspersky TigerVNC
Sources
Also known as DEBIAN-CVE-2019-15693, GHSA-xv8c-xf4m-4698, UBUNTU-CVE-2019-15693.