LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the     HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially     crafted dimensions, which can result in remote code execution. (CVE-2019-15690)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0108 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-20337:
    There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw     0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

    CVE-2019-3825:
    A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an     attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to     expire, at which time they would gain access to the logged-in user's session.

    CVE-2019-3827:
    An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows     reading and modify arbitrary files by privileged users without asking for password when no authentication     agent is running. This vulnerability can be exploited by malicious programs running under privileges of     users belonging to the wheel group to further escalate its privileges by modifying system files without     user's knowledge. Successful exploitation requires uncommon system configuration.

    CVE-2019-12447:
    An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file     ownership because setfsuid is not used.

    CVE-2019-12448:
    An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions     because the admin backend doesn't implement query_info_on_read/write.

    CVE-2019-12449:
    An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's     user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to     file:// URIs, because root privileges are unavailable.

    CVE-2019-12795:
    daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3     opened a private D-Bus server socket without configuring an authorization rule. A local attacker could     connect to this server socket and issue D-Bus method calls.(Note that the server socket only accepts a     single connection, so the attacker would have to discover the server and connect to the socket before its     owner does.)

    CVE-2019-15690:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2019-20839:
    libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

    CVE-2020-14397:
    An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer     dereference.

    CVE-2020-14405:
    An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat     size.

    CVE-2020-15503:
    LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp,     postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example,     malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.

    CVE-2020-25708:
    A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw     to send a specially crafted message that, when processed by the VNC server, would lead to a floating point     exception, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14355-1 advisory.

  - LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC     server code, which allow an attacker to read stack memory and can be abused for information disclosure.
    Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack     appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit     d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. (CVE-2019-15681)

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0920 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncserver: integer overflow and heap-based buffer overflow in libvncclient/cursor.c in     HandleCursorShape function (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0920 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libvncserver packages installed that are affected by multiple vulnerabilities:

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for LibVNCServer fixes the following issues :

CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).

CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).

CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4407-1 advisory.

    It was discovered that LibVNCServer incorrectly handled decompressing data. An attacker could possibly use     this issue to cause LibVNCServer to crash, resulting in a denial of service. (CVE-2019-15680)

    It was discovered that an information disclosure vulnerability existed in LibVNCServer when sending a     ServerCutText message. An attacker could possibly use this issue to expose sensitive information. This     issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)

    It was discovered that LibVNCServer incorrectly handled cursor shape updates. If a user were tricked in to     connecting to a malicious server, an attacker could possibly use this issue to cause LibVNCServer to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15690, CVE-2019-20788)

    It was discovered that LibVNCServer incorrectly handled decoding WebSocket frames. An attacker could     possibly use this issue to cause LibVNCServer to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.
    (CVE-2017-18922)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for LibVNCServer fixes the following issues :

  - CVE-2019-15690: Fixed a heap buffer overflow     (bsc#1160471).

  - CVE-2019-15681: Fixed a memory leak which could have     allowed to a remote attacker to read stack memory     (bsc#1155419).

  - CVE-2019-20788: Fixed a integer overflow and heap-based     buffer overflow via a large height or width value     (bsc#1170441).

This update was imported from the SUSE:SLE-15:Update update project.

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1411 advisory.

    Integer Overflow or Wraparound leads to Heap-based Buffer Overflow (CVE-2019-15690)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0913 advisory.

    [0.9.9-14]
    - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client)       (bug #1814339)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0913 advisory.

  - libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

  - libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-     based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
    (CVE-2019-20788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0920 advisory.

    [0.9.11-9.2]
    - Enable gating (bug #1681199)

    [0.9.11-9.1]
    - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client)       (bug #1814342)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0913 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libvncserver: HandleCursorShape() integer overflow     resulting in heap-based buffer overflow (CVE-2019-15690)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0921 advisory.

    LibVNCServer is a C library that enables you to implement VNC server functionality into own programs.

    Security Fix(es):

    * libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow     (CVE-2019-15690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In libvncserver, through libvncclient/cursor.c, there is a possibility of a heap overflow, as reported by Pavel Cheremushkin.

For Debian 8 'Jessie', this problem has been fixed in version 0.9.9+dfsg2-6.1+deb8u7.

We recommend that you upgrade your libvncserver packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
250522	Linux Distros Unpatched Vulnerability : CVE-2019-15690	Nessus	Misc.	high
236504	Alibaba Cloud Linux 3 : 0108: GNOME (ALINUX3-SA-2022:0108)	Nessus	Alibaba Cloud Linux Local Security Checks	high
150539	SUSE SLES11 Security Update : LibVNCServer (SUSE-SU-2020:14355-1)	Nessus	SuSE Local Security Checks	critical
145958	CentOS 8 : libvncserver (CESA-2020:0920)	Nessus	CentOS Local Security Checks	critical
143980	NewStart CGSL CORE 5.05 / MAIN 5.05 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0087)	Nessus	NewStart CGSL Local Security Checks	critical
143006	RHEL 8 : libvncserver (RHSA-2020:0920)	Nessus	Red Hat Local Security Checks	critical
140281	NewStart CGSL CORE 5.04 / MAIN 5.04 : libvncserver Multiple Vulnerabilities (NS-SA-2020-0038)	Nessus	NewStart CGSL Local Security Checks	critical
138259	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-2)	Nessus	SuSE Local Security Checks	critical
138132	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : LibVNCServer vulnerabilities (USN-4407-1)	Nessus	Ubuntu Local Security Checks	critical
136453	openSUSE Security Update : LibVNCServer (openSUSE-2020-624)	Nessus	SuSE Local Security Checks	critical
136396	SUSE SLES12 Security Update : LibVNCServer (SUSE-SU-2020:1165-1)	Nessus	SuSE Local Security Checks	critical
136395	SUSE SLED15 / SLES15 Security Update : LibVNCServer (SUSE-SU-2020:1164-1)	Nessus	SuSE Local Security Checks	critical
135929	Amazon Linux 2 : libvncserver (ALAS-2020-1411)	Nessus	Amazon Linux Local Security Checks	high
134931	Oracle Linux 7 : libvncserver (ELSA-2020-0913)	Nessus	Oracle Linux Local Security Checks	high
134913	CentOS 7 : libvncserver (RHSA-2020:0913)	Nessus	CentOS Local Security Checks	critical
134887	Oracle Linux 8 : libvncserver (ELSA-2020-0920)	Nessus	Oracle Linux Local Security Checks	high
134861	RHEL 7 : libvncserver (RHSA-2020:0913)	Nessus	Red Hat Local Security Checks	critical
134847	Scientific Linux Security Update : libvncserver on SL7.x x86_64 (20200323)	Nessus	Scientific Linux Local Security Checks	high
134837	RHEL 8 : libvncserver (RHSA-2020:0921)	Nessus	Red Hat Local Security Checks	critical
134633	Debian DLA-2146-1 : libvncserver security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-15690

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

critical

high

critical

high