CVE-2019-8287 — Classic Buffer Overflow in Tightvnc

CWE-120 — Classic Buffer Overflow5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
3.5%
top 12.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TightvncDebian TightvncKaspersky Tightvnc
Timeline
PublishedOct 29
Latest updateMay 24

Description

TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/tightvnc< tightvnc 1:1.3.9-9.1 (bookworm)
▶Debiantightvnc/tightvnc< 1:1.3.9-9.1+3
▶NVDtightvnc/tightvnc1.3.10
▶CVEListV5kaspersky/tightvnc1.3.10

🔴Vulnerability Details

2
GHSA
GHSA-frvw-vf5g-vxwg: TightVNC code version 1↗2022-05-24
▶
OSV
CVE-2019-8287: TightVNC code version 1↗2019-10-29
▶

📋Vendor Advisories

2
CISA ICS
Siemens Products using TightVNC (Update A)↗2020-12-08
▶
Debian
CVE-2019-8287: tightvnc - TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP m...↗2019
▶