CVE-2019-15679
Critical · 9.8CVSS
9.8
EPSS
11.8%
Published
Oct 29, 2019
CISA due date
—
The record
TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:12 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:13 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:8 | tightvnc | 0 | 1.3.9-6.5+deb8u1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | tightvnc | 0 | 1.3.9-81.15.3.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | tightvnc | 0 | 1.3.9-81.15.3.1 |
| Ubuntu:14.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:16.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:16.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:16.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:16.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:18.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:18.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:18.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:18.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:20.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:20.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:20.04:LTS | veyon | 0 | No fix |
| Ubuntu:20.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:20.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:20.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:22.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:22.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:22.04:LTS | veyon | 0 | No fix |
| Ubuntu:22.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:22.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:22.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:24.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:24.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:24.04:LTS | veyon | 0 | No fix |
| Ubuntu:24.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:24.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:24.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:24.10 | ssvnc | 0 | No fix |
| Ubuntu:24.10 | tightvnc | 0 | No fix |
| Ubuntu:24.10 | veyon | 0 | No fix |
| Ubuntu:24.10 | vncsnapshot | 0 | No fix |
| Ubuntu:24.10 | x11vnc | 0 | No fix |
| Ubuntu:24.10 | x2vnc | 0 | No fix |
| Ubuntu:25.04 | ssvnc | 0 | No fix |
| Ubuntu:25.04 | tightvnc | 0 | No fix |
| Ubuntu:25.04 | veyon | 0 | No fix |
| Ubuntu:25.04 | vncsnapshot | 0 | No fix |
| Ubuntu:25.04 | x2vnc | 0 | No fix |
| Ubuntu:25.10 | ssvnc | 0 | No fix |
| Ubuntu:25.10 | tightvnc | 0 | No fix |
| Ubuntu:25.10 | veyon | 0 | No fix |
| Ubuntu:25.10 | vncsnapshot | 0 | No fix |
| Ubuntu:25.10 | x2vnc | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | tightvnc | 0 | 1.3.9-6.5+deb8u1build0.14.04.1~esm1 |
| Ubuntu:Pro:14.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | x11vnc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | x2vnc | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | ssvnc | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | veyon | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | vncsnapshot | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | x2vnc | 0 | No fix |
Related vulnerabilities
- CVE-2019-8287 TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro… Also affects tightvnc
- CVE-2019-15678 TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler… Also affects tightvnc
- CVE-2014-6053 The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer… Also affects tightvnc
- CVE-2021-42785 Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote… Also affects tightvnc
- CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
- CVE-2026-112397 Pillow is a Python imaging library. CWE-787
- CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
- CVE-2026-89088 A flaw was found in parted. CWE-787