CVE-2019-15683

critical · 9.8

TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e.

9.8

CVSS

19.4%

EPSS (exploit prob.)

97th

EPSS percentile

2019-10-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-121CWE-787

Affected products

Vendor	Product	Affected versions
turbovnc	turbovnc	< 2.2.3

Check a specific version with /api/v1/cve/match.

References

https://github.com/TurboVNC/turbovnc/commit/cea98166008301e614e0d36776bf9435a536136e
https://github.com/TurboVNC/turbovnc/commit/cea98166008301e614e0d36776bf9435a536136e

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-15683