What’s Vulnerable › Vulnerabilities

CVE-2019-15681

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-29 · updated 2026-06-17
• Weakness: CWE-665

Description

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
• Debian Linux: 8.0, 9.0
• Libvnc Project Libvncserver: before 0.9.12 — fixed in 0.9.12
• Siemens Simatic Itc1500 Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0
• Siemens Simatic Itc1500 Pro Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0
• Siemens Simatic Itc1900 Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0
• Siemens Simatic Itc1900 Pro Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0
• Siemens Simatic Itc2200 Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0
• Siemens Simatic Itc2200 Pro Firmware: from 3.0.0.0 before 3.2.1.0 — fixed in 3.2.1.0

How to fix

Upgrade to a fixed version: Libvnc Project Libvncserver 0.9.12; Siemens Simatic Itc1500 Firmware 3.2.1.0; Siemens Simatic Itc1500 Pro Firmware 3.2.1.0; Siemens Simatic Itc1900 Firmware 3.2.1.0; Siemens Simatic Itc1900 Pro Firmware 3.2.1.0; Siemens Simatic Itc2200 Firmware 3.2.1.0; Siemens Simatic Itc2200 Pro Firmware 3.2.1.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
• https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a
• https://lists.debian.org/debian-lts-announce/2019/10/msg00039.html
• https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
• https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html
• https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
• https://usn.ubuntu.com/4407-1/
• https://usn.ubuntu.com/4547-1/
• https://usn.ubuntu.com/4573-1/
• https://usn.ubuntu.com/4587-1/

Get alerted when CVE-2019-15681 or the next vulnerability affects your stack