CVE-2019-15695

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-754 CWE-787

Affected software

Vendor	Product	Versions
Kaspersky	TigerVNC	1.10.0

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.htmlMailing List, Third Party Advisory
https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89Patch, Third Party Advisory
https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/12/20/2Exploit, Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.htmlMailing List, Third Party Advisory
https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89Patch, Third Party Advisory
https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/12/20/2Exploit, Mailing List, Third Party Advisory

Timeline

Published: Dec 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156984.3In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensit CVE-2019-156999.1An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDeco CVE-2019-15704.8The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server s CVE-2019-157006.1public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by CVE-2019-157018.8components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as CVE-2019-157027.5In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial CVE-2019-157037.5An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token an CVE-2019-157045.5A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information CVE-2019-157057.5An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unaut CVE-2019-157065.4An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below an CVE-2019-157074.9An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perfor CVE-2019-157086.7A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.