CVE-2019-15680

2019-10-2919:15:18

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

74.7%

JSON

TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.

OSVersionArchitecturePackageVersionFilename
Debian12alllibvncserver<= 0.9.14+dfsg-1libvncserver_0.9.14+dfsg-1_all.deb
Debian11alllibvncserver<= 0.9.13+dfsg-2+deb11u1libvncserver_0.9.13+dfsg-2+deb11u1_all.deb
Debian999alllibvncserver<= 0.9.14+dfsg-1libvncserver_0.9.14+dfsg-1_all.deb
Debian13alllibvncserver<= 0.9.14+dfsg-1libvncserver_0.9.14+dfsg-1_all.deb
Debian12alltightvnc< 1:1.3.9-9.1tightvnc_1:1.3.9-9.1_all.deb
Debian11alltightvnc< 1:1.3.9-9.1tightvnc_1:1.3.9-9.1_all.deb
Debian999alltightvnc< 1:1.3.9-9.1tightvnc_1:1.3.9-9.1_all.deb
Debian13alltightvnc< 1:1.3.9-9.1tightvnc_1:1.3.9-9.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libvncserver	<= 0.9.14+dfsg-1	libvncserver_0.9.14+dfsg-1_all.deb
Debian	11	all	libvncserver	<= 0.9.13+dfsg-2+deb11u1	libvncserver_0.9.13+dfsg-2+deb11u1_all.deb
Debian	999	all	libvncserver	<= 0.9.14+dfsg-1	libvncserver_0.9.14+dfsg-1_all.deb
Debian	13	all	libvncserver	<= 0.9.14+dfsg-1	libvncserver_0.9.14+dfsg-1_all.deb
Debian	12	all	tightvnc	< 1:1.3.9-9.1	tightvnc_1:1.3.9-9.1_all.deb
Debian	11	all	tightvnc	< 1:1.3.9-9.1	tightvnc_1:1.3.9-9.1_all.deb
Debian	999	all	tightvnc	< 1:1.3.9-9.1	tightvnc_1:1.3.9-9.1_all.deb
Debian	13	all	tightvnc	< 1:1.3.9-9.1	tightvnc_1:1.3.9-9.1_all.deb