CVE-2019-8287
Critical · 9.8CVSS
9.8
EPSS
19.5%
Published
Oct 29, 2019
CISA due date
—
The record
TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:12 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:13 | tightvnc | 0 | 1:1.3.9-9.1 |
| Debian:8 | tightvnc | 0 | 1.3.9-6.5+deb8u1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | tightvnc | 0 | 1.3.9-81.15.3.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | tightvnc | 0 | 1.3.9-81.15.3.1 |
| Ubuntu:16.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:18.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:20.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:22.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:24.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:24.10 | tightvnc | 0 | No fix |
| Ubuntu:25.04 | tightvnc | 0 | No fix |
| Ubuntu:25.10 | tightvnc | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | tightvnc | 0 | 1.3.9-6.5+deb8u1build0.14.04.1~esm1 |
| Ubuntu:Pro:16.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | tightvnc | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | tightvnc | 0 | No fix |
Related vulnerabilities
- CVE-2019-15678 TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler… Also affects tightvnc
- CVE-2019-15679 TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection… Also affects tightvnc
- CVE-2014-6053 The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer… Also affects tightvnc
- CVE-2021-42785 Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote… Also affects tightvnc
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-120
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-120
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-120
- CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. CWE-120