VulnerableCode Package Details - pkg:deb/debian/tightvnc@1.2.9-21

Search for packages

Vulnerability	Summary	Fixed by
VCID-4qnx-cfrg-bfcg Aliases: CVE-2018-20022	LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-9rxx-s7ug-1ucr Aliases: CVE-2019-15678	TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity.	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-avna-zr4w-sbb2 Aliases: CVE-2019-15679	TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-jc77-4mmq-yfgc Aliases: CVE-2018-20021	LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC client code. Vulnerability allows attacker to consume excessive amount of resources like CPU and RAM	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-kr7e-s1j9-uuha Aliases: CVE-2014-6053		1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-vgyx-qtzw-9qa5 Aliases: CVE-2019-8287	TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-vjz6-kw2t-cucm Aliases: CVE-2019-15681	LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-w91q-2f69-7fe9 Aliases: CVE-2018-7225	An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.	1:1.3.10-3 Affected by 0 other vulnerabilities.
VCID-xsez-3gum-tyhg Aliases: CVE-2019-15680	TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.	1:1.3.10-3 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-4qnx-cfrg-bfcg
Aliases:
CVE-2018-20022

LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memory layout and in bypassing ASLR