This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-15694 →

DEBIAN-CVE-2019-15694

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs...

Original description

The description as published by the source.

TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tigervnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1"}]}]

Debian:13 tigervnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1"}]}]

References

advisory security-tracker.debian.org