Memory Leak Vulnerability in libvncserver: CVE-2019-15681
Summary
ALPINE-CVE-2019-15681: LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Affects libvncserver versions < 0.9.11-r3. Fixed in 0.9.11-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvncserver is an open-source library that enables the implementation of VNC (Virtual Network Computing) server functionality. It allows remote access to graphical user interfaces over a network. The library is widely used in various applications that require remote desktop capabilities. However, it has been identified to have a critical vulnerability that can lead to information disclosure through a memory leak.
Vulnerability Detail
The vulnerability, identified as CVE-2019-15681, originates from a memory leak in the VNC server code prior to commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. This flaw allows an attacker to read stack memory, potentially leading to sensitive information disclosure. The vulnerability can be exploited over network connectivity, and when combined with other vulnerabilities, it may allow attackers to bypass Address Space Layout Randomization (ASLR), increasing the risk of further exploitation.
How To Fix
Minimum fixed version
0.9.11-r3
This is the first release that contains the fix.
sudo apk add --upgrade libvncserverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting network access to the VNC server or implementing firewall rules to limit exposure until the package can be updated. Additionally, monitoring network traffic for unusual activity may help mitigate risks.
Conclusion
The CVE-2019-15681 vulnerability in libvncserver poses a significant risk due to its potential for information disclosure through a memory leak. It is crucial for users of affected versions to update their packages to the patched versions to mitigate this risk. Additionally, employing temporary workarounds can help protect systems until updates are applied.
See every vulnerability recorded for libvncserver →
FAQ
CVE-2019-15681 is a memory leak vulnerability in the libvncserver library that can lead to information disclosure.
An attacker can exploit this vulnerability over network connectivity to read sensitive stack memory.
The vulnerability can lead to information disclosure and, when combined with other vulnerabilities, may allow attackers to bypass ASLR.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2019-15681 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvncserver.
