CVE-2019-15680
Publication date 29 October 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
From the Ubuntu Security Team
Pavel Cheremushkin discovered that TightVNC has a null pointer dereference vulnerability. An attacker could use it to cause a Denial of Service or possible a remote code execution.
Status
Package | Ubuntu Release | Status |
---|---|---|
libvncserver | 24.04 LTS noble |
Not affected
|
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Fixed 0.9.12+dfsg-9ubuntu0.1
|
|
18.04 LTS bionic |
Fixed 0.9.11+dfsg-1ubuntu1.2
|
|
16.04 LTS xenial |
Fixed 0.9.10+dfsg-3ubuntu0.16.04.4
|
|
14.04 LTS trusty | Not in release | |
ssvnc | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Not in release | |
tightvnc | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Fixed 1.3.9-6.5+deb8u1build0.14.04.1~esm1
|
|
veyon | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
vncsnapshot | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty | Not in release | |
x11vnc | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
mdeslaur
per upstream, this is a non-issue in libvncserver as checks are already done in zlib, see: https://github.com/LibVNC/libvncserver/issues/359#issuecomment-599133529 for completeness, the fix was added to focal and earlier releases, but will not be added to groovy+
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-4407-1
- LibVNCServer vulnerabilities
- 1 July 2020