CVE-2019-8259: High severity ultravnc vulnerability
UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1199.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-8259?
CVE-2019-8259 has a medium severity rating due to potential information disclosure risks associated with memory leaks.
How do I fix CVE-2019-8259?
To fix CVE-2019-8259, update affected software to the latest version provided by the vendor, ensuring it is patched for this vulnerability.
Which software is affected by CVE-2019-8259?
CVE-2019-8259 affects multiple versions of UltraVNC, as well as several Siemens products including the SINUMERIC series and Comfort Panels.
What are the potential impacts of exploiting CVE-2019-8259?
Exploiting CVE-2019-8259 could allow an attacker to read sensitive stack memory, leading to information disclosure and potential ASLR bypass.
Is there a known workaround for CVE-2019-8259?
Currently, the recommended approach for CVE-2019-8259 is to apply the latest software updates rather than relying on workarounds.