Beauty Out of Chaos: Elevating Cybersecurity to an Art Form – Part 1

How many of you can remember what it was like managing IT security 10 years ago? How about two decades? The truth is that the landscape was so utterly different back then that any comparisons with today are a little unfair. Yet they’re useful in one key regard: to teach us just how complex and...

CVE-2019-8261

CVE-2019-8261: UltraVNC revision 1199 contains an out-of-bounds read in the VNC client CoRRE decoder caused by a multiplication overflow. Exploitation is reported as feasible via network connectivity. The vulnerability has been addressed in revision 1200. Affected component: UltraVNC client VNC d...

CVE-2019-8260

UltraVNC CVE-2019-8260 is an out-of-bounds read affecting UltraVNC client RRE decoder caused by a multiplication overflow in revision 1199. The vulnerability can be exploited remotely over the network and has been fixed in revision 1200. Connected documents (e.g., Siemens/ICS advisories) corrobor...

CVE-2019-8262

UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204...

CVE-2019-8260

UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200...

CVE-2019-8263

UltraVNC revision 1205 is affected by a stack-based buffer overflow in the VNC client code (ShowConnInfo) that can cause a DoS when triggered over the network; exploitation requires no user interaction. The vulnerability is fixed in revision 1206. Remediation: upgrade to 1206 or later and apply v...

CVE-2019-8258

UltraVNC revision 1198 contains a heap-based buffer overflow in the VNC client code that can lead to code execution and is exploitable over the network. The issue is fixed in revision 1199. Affected product: UltraVNC (VNC client component). Mitigation: upgrade to revision 1199 or later to remedia...

CVE-2019-8259

UltraVNC revision 1198 contains multiple memory leaks CWE-655 in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be...

CVE-2019-8263

UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service DoS condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This...

CVE-2019-8261

UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200...

CVE-2018-15361

UltraVNC revision 1198 contains a buffer underflow in the VNC client code that could potentially allow code execution. The vulnerability is exploitable over network connectivity, and Siemens/CISA context confirms the fix is to upgrade to revision 1199. No further technical details are provided in...

CVE-2019-8258

UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199...

CVE-2018-15361

UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199...

PT-2019-5951

Name of the Vulnerable Software and Affected Versions UltraVNC revision 1205 Description The issue is related to a stack-based buffer overflow in the VNC client code inside the ShowConnInfo routine. This can lead to a denial of service DoS condition. The attack appears to be exploitable via netwo...

CVE-2019-8261: Out-of-bounds Read

UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200...

PT-2019-4937

Name of the Vulnerable Software and Affected Versions UltraVNC versions prior to revision 1204 Description The issue is related to an out-of-bounds access vulnerability in the VNC client inside the RAW decoder of UltraVNC, potentially allowing code execution. This vulnerability can be exploited v...

CVE-2019-8263: Stack-based Buffer Overflow

UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service DoS condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This...

CVE-2019-8262: Heap-based Buffer Overflow

UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204...

CVE-2019-8260: Out-of-bounds Read

UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200...

PT-2019-18956

Name of the Vulnerable Software and Affected Versions UltraVNC revision 1198 Description The issue is related to multiple memory leaks in VNC client code, allowing an attacker to read stack memory, which can be used for information disclosure. When combined with another vulnerability, it can leak...