{"id":"CVE-2019-15690","aliases":["DEBIAN-CVE-2019-15690","DLA-2146-1","EUVD-2019-6629","GHSA-rx9w-c6jv-2grg","MGASA-2020-0164","RHSA-2020:0913","RHSA-2020:0920","RHSA-2020:0921","SUSE-SU-2020:1164-1","SUSE-SU-2020:1164-2","SUSE-SU-2020:1165-1","SUSE-SU-2020:14355-1","UBUNTU-CVE-2019-15690","USN-4407-1","openSUSE-SU-2020:0624-1","openSUSE-SU-2024:10598-1"],"status":"published","title":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the...","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00768,"percentile":0.55983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2019-12-31T00:00:00Z","modified":"2026-09-21T07:02:12Z","fixes":[{"ecosystem":"Debian:12","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvncserver","fixed_in":["0.9.12+dfsg-9"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libvncserver","fixed_in":["0.9.12-2.2.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","fixed_in":["0.9.10+dfsg-3ubuntu0.16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","fixed_in":["0.9.11+dfsg-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libvncserver","fixed_in":["0.9.12+dfsg-9ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9+dfsg2-6.1+deb8u7"}]}],"versions":["0.9.9+dfsg-6.1","0.9.9+dfsg2-6.1+deb8u1","0.9.9+dfsg2-6.1+deb8u2","0.9.9+dfsg2-6.1+deb8u3","0.9.9+dfsg2-6.1+deb8u4","0.9.9+dfsg2-6.1+deb8u5","0.9.9+dfsg2-6.1+deb8u6"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-2.2.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.9-14.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libvncserver-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_1.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"libvncserver-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.11-9.el8_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-4.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-17.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-160.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"x11vnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.13-1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.4"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2","0.9.10+dfsg-3ubuntu0.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.2"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1","0.9.11+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9ubuntu0.1"}]}],"versions":["0.9.11+dfsg-1.3","0.9.12+dfsg-3ubuntu3","0.9.12+dfsg-6","0.9.12+dfsg-7","0.9.12+dfsg-8","0.9.12+dfsg-9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10+dfsg-3ubuntu0.16.04.4"}]}],"versions":["0.9.10+dfsg-3","0.9.10+dfsg-3build1","0.9.10+dfsg-3ubuntu0.16.04.1","0.9.10+dfsg-3ubuntu0.16.04.2","0.9.10+dfsg-3ubuntu0.16.04.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11+dfsg-1ubuntu1.2"}]}],"versions":["0.9.11+dfsg-1","0.9.11+dfsg-1ubuntu1","0.9.11+dfsg-1ubuntu1.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libvncserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12+dfsg-9ubuntu0.1"}]}],"versions":["0.9.11+dfsg-1.3","0.9.12+dfsg-3ubuntu3","0.9.12+dfsg-6","0.9.12+dfsg-7","0.9.12+dfsg-8","0.9.12+dfsg-9"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"LibVNCServer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-lp151.7.3.1"}]}],"bundled":3}],"products":[{"vendor":"libvnc","product":"libvncserver"}],"references":[{"url":"https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12/","tags":["third-party-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15690","tags":["advisory"]},{"url":"https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12"},{"url":"https://github.com/advisories/GHSA-rx9w-c6jv-2grg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15690","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0164.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25918","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2146","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0913","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811948","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0913.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15690","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20788","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0920","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0920.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0921","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0921.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201164-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1155419","tags":["report"]},{"url":"https://bugzilla.suse.com/1160471","tags":["report"]},{"url":"https://bugzilla.suse.com/1170441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20788","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201164-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201165-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014355-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15690","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/12/20/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4407-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20788","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/X6PQATT2HQIOVLXBCKXH2SSVO2ZT5TCP/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25708","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-15690","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T17:53:58.866Z","modified":"2025-01-24T18:22:55.433Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2019-6629","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T17:53:58Z","modified":"2025-01-24T18:22:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:13.589007Z"}],"ghsa":[{"id":"GHSA-rx9w-c6jv-2grg","title":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the...","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T18:31:13Z","modified":"2025-01-24T18:31:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:59:40.157445Z"}],"nvd":[{"id":"CVE-2019-15690","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T18:15:27.657Z","modified":"2026-06-17T02:20:52.917Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:05:49.934131Z"}],"osv":[{"id":"DEBIAN-CVE-2019-15690","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T18:15:27.657Z","modified":"2026-09-21T07:02:12.483279616Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:0913","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:21Z","modified":"2026-06-27T10:09:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0920","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:28Z","modified":"2026-06-27T10:09:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0921","title":"Red Hat Security Advisory: libvncserver security update","status":"published","published":"2024-09-16T03:47:36Z","modified":"2026-06-27T10:09:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-15690","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2019-12-31T00:00:00Z","modified":"2026-04-22T12:12:40.360474Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"CVE-2019-15690","description":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution.","status":"published","published":"2025-01-24T18:15:27Z","modified":"2026-04-16T04:31:37.807666808Z","updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DLA-2146-1","title":"libvncserver - security update","status":"published","published":"2020-03-18T00:00:00Z","modified":"2026-03-09T01:21:18.946031Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0164","title":"Updated libvncserver packages fix security vulnerability","description":"Updated libvncserver packages fix security vulnerability:\n\nIn libvncserver, through libvncclient/cursor.c, there is a possibility\nof a heap overflow, as reported by Pavel Cheremushkin (CVE-2019-15690).\n","status":"published","published":"2020-04-15T10:12:14Z","modified":"2026-04-16T04:43:54.093665697Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0624-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-05-08T10:22:03Z","modified":"2026-02-04T02:23:54.742498Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10598-1","title":"LibVNCServer-devel-0.9.13-3.1 on GA media","description":"These are all security issues fixed in the LibVNCServer-devel-0.9.13-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:49.041318Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:1164-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:28:50Z","modified":"2026-02-04T02:23:09.069412Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1164-2","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-07-07T11:43:24Z","modified":"2026-02-04T02:20:31.416322Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1165-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:32:01Z","modified":"2026-02-04T03:38:27.196955Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14355-1","title":"Security update for LibVNCServer","description":"This update for LibVNCServer fixes the following issues:\n\n- CVE-2019-15690: Fixed a heap buffer overflow (bsc#1160471).\n- CVE-2019-15681: Fixed a memory leak which could have allowed to a remote attacker to read stack memory (bsc#1155419).\n- CVE-2019-20788: Fixed a integer overflow and heap-based buffer overflow via a large height or width value (bsc#1170441).\n","status":"published","published":"2020-05-04T09:32:51Z","modified":"2026-02-04T04:29:34.925515Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4407-1","title":"libvncserver vulnerabilities","description":"It was discovered that LibVNCServer incorrectly handled decompressing data. An\nattacker could possibly use this issue to cause LibVNCServer to crash,\nresulting in a denial of service. (CVE-2019-15680)\n\nIt was discovered that an information disclosure vulnerability existed in\nLibVNCServer when sending a ServerCutText message. An attacker could possibly\nuse this issue to expose sensitive information. This issue only affected\nUbuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2019-15681)\n\nIt was discovered that LibVNCServer incorrectly handled cursor shape updates.\nIf a user were tricked in to connecting to a malicious server, an attacker\ncould possibly use this issue to cause LibVNCServer to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.\n(CVE-2019-15690, CVE-2019-20788)\n\nIt was discovered that LibVNCServer incorrectly handled decoding WebSocket\nframes. An attacker could possibly use this issue to cause LibVNCServer to\ncrash, resulting in a denial of service, or possibly execute arbitrary code.\nThis issue only affected Ubuntu 19.10, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.\n(CVE-2017-18922)\n","status":"published","published":"2020-07-01T23:44:41Z","modified":"2026-04-27T15:39:05.015501Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}