CVE-2019-8273 — Heap-based Buffer Overflow in Ultravnc

CWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds Write4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
4.0%
top 11.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Siemens Sinumerik Access Mymachine P2PSiemens Sinumerik PCU Base Win10 Software IPCUvnc Ultravnc+2 more
Timeline
PublishedMar 8
Latest updateMay 13

Description

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶NVDuvnc/ultravnc< 1.2.2.3
▶CVEListV5kaspersky_lab/ultravnc1.2.2.3

🔴Vulnerability Details

1
GHSA
GHSA-f693-2xf3-fcpc: UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result↗2022-05-13
▶

📋Vendor Advisories

1
CISA ICS
Siemens SINUMERIK↗2020-06-12
▶

💬Community

1
Bugzilla
CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service↗2019-03-04
▶