CVE-2019-15680

Published: 29 October 2019

TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.

From the Ubuntu Security Team

Pavel Cheremushkin discovered that TightVNC has a null pointer dereference vulnerability. An attacker could use it to cause a Denial of Service or possible a remote code execution.

Notes

per upstream, this is a non-issue in libvncserver as checks are
already done in zlib, see:
https://github.com/LibVNC/libvncserver/issues/359#issuecomment-599133529
for completeness, the fix was added to focal and earlier
releases, but will not be added to groovy+

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2018/12/10/5
• https://ubuntu.com/security/notices/USN-4407-1
• https://www.cve.org/CVERecord?id=CVE-2019-15680
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/LibVNC/libvncserver/issues/359