Stack Buffer Overflow Vulnerability in TurboVNC Server by TurboVNC
CVE-2019-15683

9.8CRITICAL

Key Information:

Vendor
Kaspersky
Status
Turbovnc
Vendor
CVE Published:
29 October 2019

Summary

The TurboVNC Server contains a stack buffer overflow vulnerability that can lead to remote code execution. This flaw exists due to insufficient protection of the stack frame, which lacks a stack canary. Attackers could potentially exploit this vulnerability through network connectivity, provided they have the necessary authorization on the server. The issue has been addressed in a subsequent commit that mitigates the risk associated with this vulnerability.

Affected Version(s)

TurboVNC commit prior to cea98166008301e614e0d36776bf9435a536136e

References

https://github.com/TurboVNC/turbovnc/commit/cea9816600830...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.