CVE-2019-8263
MEDIUMUltraVNC < 1.2.2.3 - Stack-based Buffer Overflow in ShowConnInfo Routine
Title source: llmDescription
UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This vulnerability has been fixed in revision 1206.
References (7)
Core 7
Core References
Not Applicable, Third Party Advisory x_refsource_misc
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-009-ultravnc-access-of-memory-location-after-end-of-buffer/
Third Party Advisory x_refsource_misc
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-010-ultravnc-stack-based-buffer-overflow/
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-161-06
Vendor Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf
Vendor Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
Scores
CVSS v3
6.5
EPSS
0.0083
EPSS Percentile
74.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-121
CWE-787
Status
published
Products (4)
siemens/sinumerik_access_mymachine\/p2p
< 4.8
siemens/sinumerik_pcu_base_win10_software\/ipc
< 14.00
siemens/sinumerik_pcu_base_win7_software\/ipc
< 12.01
uvnc/ultravnc
< 1.2.2.3
Published
Mar 05, 2019
Tracked Since
Feb 18, 2026