High
Security advisory
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-15694
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
osv:CVE-2019-15694
Complete source record
{
"id": "09cbf6d9b7866c0d5dbaeedab92b98e3453121f05d5137ef2ee50f7ca26f5d0d",
"url": "https://osv.dev/vulnerability/CVE-2019-15694",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-15694",
"summary": "TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.",
"evidence": "osv:CVE-2019-15694",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-15694",
"aliases": [
"CVE-2019-15694"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cendioossman/tigervnc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0943c006c7d900dfc0281639e992791d6c567438"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "0943c006c7d900dfc0281639e992791d6c567438"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.1.90",
"v0.0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15694.json",
"vanir_signatures": [
{
"id": "CVE-2019-15694-0bfa25d9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"311598666017041075854840215659579403669",
"269078340988576390873214762699109418917",
"1828546582398084752010188458714278173",
"19919295865579185429183147363928091644"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rfb/util.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-10ac2cc8",
"digest": {
"length": 979,
"function_hash": "53365734544241902038890594750217277871"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/RandomStream.cxx",
"function": "RandomStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-114f5767",
"digest": {
"threshold": 0.9,
"line_hashes": [
"180124185349625532223066568424718232966",
"179616192323364511610720996756045880428",
"16584269604604038072734221904726607238",
"318947165258731905289930245013781284590",
"61821847763961388761352671313281822587",
"108664684633731033808731281586981037574",
"233991859924988536612159427661257895873",
"234608700770937511980538456558404500518",
"61881996884287099804972689811368920821",
"253571620117286683787177667477747420171",
"39372851218898380150466779854840343898",
"114101300490435070298614353094966462430",
"102935837819193458749451387166207867538",
"193960071455421712514699818098667492547",
"254241238868873589210748370677936619916",
"258084985038955342567817060433442017001",
"276112720315526178871342918614968892198",
"133009061574878650333733987919427179190"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-1331cc5f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"328717684117144887185469299313430717507",
"314209661762549758000212546228713783800",
"64225417089128373134628771208243589062",
"209676732379503000399595186400383084941",
"251803333918230122478245468583075328347",
"12005430807026892274384504126840518178",
"269120689213011573625401191312074551578",
"92002302527214785617610467023914458719",
"312776925776183088925506755206450347913",
"250421171256381384524523096026282216235",
"308027022213979392859674050744757048715",
"310627813914984905034755179306137287878",
"110262423099119989182697264183608941902",
"311189570801243443388184636961581751331",
"207599128141034429536320952988112017535",
"191777005761433128929594347276544060185",
"232111282591450778276508934925926156997",
"214259066992595256318519476723316223283",
"111555706349026741974109906905363876401",
"143228689660597205511078571039618140355",
"167770164802817375710647931392489046955"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSOutStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-16843a7b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69793656717310463674640305268808304168",
"91947087622627896289314664098227549067",
"65232604713415907220110866938586710547",
"179896259442894048142803320304249123809",
"274571916785126300182665764249003004908",
"237476717238198436138378743031744372771",
"144844418758744162861763562536397910895",
"156855654021995595857708391797154413341",
"167685207350421184377348440022434530319",
"258555689971379539277472978895537480558",
"105702098976378447293694643207319458080",
"38287393330885531036164770161874613643",
"125989221054494078515747762660520531131",
"235727160204384019504710177397071548308",
"145693557058584056011984568771595677944",
"214213192044660418069072243726201633835",
"7851918672379023761553015807710331999",
"86482715052746973815825821395828794042",
"18171819995982907179236426240211350197",
"68122059487515959808629726426095957756",
"116213261666766818994158737611804175093",
"105430076459779583605915203935078645481",
"258181824916261776365368018148112825974",
"106049802199956291321714796597164374203",
"298129102028360239758945650813357964143",
"140167372207471910220620239791622500218",
"192189694713213321899398061219284388399",
"29678474713659706226847579755512553177",
"87472591540829846168772106745607125585",
"878366372498132726676001595404101648",
"294623677796087169748585800756836401244",
"159357207374540109968871008366665114571",
"209998587867419728528968067877208817397",
"305429497540421196588732047000713911968",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997",
"104514500238732893537535598494722673620",
"80046177733237847910553060511967930608",
"293252368160258809076618100083957667627",
"254709268907262906810842092282203741368"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdInStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-1fecc054",
"digest": {
"threshold": 0.9,
"line_hashes": [
"268640148340531277896574409077737591752",
"313457341295742025200235747942188398304",
"268725475865432573234886604303391089482",
"260121520990603886808131758990433300882",
"275692798203705761915947666676129600403",
"100815701349490666172817321628431096154",
"318732625325733733288593029159732469066",
"262220762078756918193187460742680342370",
"232651885134133701589821051842930464412",
"198056916689628914712145005204404951961",
"41351851371112405459621932788764114085",
"319542336057733926353925869210419378466",
"308257205924958904343168570877413583234",
"121354582152715180645503079221159803466",
"327866475121707879889385392102477594558",
"244444786174270366923303736523173968543",
"109411159785153605178927968121428480248",
"18611198680331023027662372442254381908",
"161044162470258601011537841424521877620",
"30520579385772338558346168905997622432",
"144159655586310837620939110079500500475",
"228970359307372173059698035635972754941",
"276045892784981726110468017735193920444",
"7638937581798650741883730587886267184",
"228137293814496458159979232211716871075",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997",
"218609120963872124491496712430194427322",
"5825371639267421460624296666167553349",
"140710486739892172925480677180073574985",
"273869871393202692402148464761686487529"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdOutStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-2bc31e78",
"digest": {
"length": 160,
"function_hash": "240125044736488558608346733437849059974"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "tests/perf/encperf.cxx",
"function": "DummyOutStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-3acabd26",
"digest": {
"length": 882,
"function_hash": "301583659804354913963397677921718786323"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexInStream.cxx",
"function": "HexInStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-3c59942e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"103803959313158531927962339863683708380",
"161717359440526906122547532493707236330",
"256635271931092041500639717728628994222",
"85623057982273318179755298144604449752",
"215168736530461362376662872157357814342",
"85811419895922922385833331966125523520",
"183074475327487877115968824181465263440",
"60212908821143655389460432794620098905",
"40971903096055332930941605357586499199",
"112024064971389857010021716835325334449"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "win/rfb_win32/Registry.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-4216d915",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79944389184895293536731598002789735701",
"178740628494402811537938334424460365484",
"7785674455617877984375619559980760129",
"226347489110728221782817235783791887276",
"78251406796619045711986039569154037270",
"265037659978660194624523071072685954579",
"66197770443879629629033412155173022292",
"291550906526242910475642293551342667133",
"132391428378767741918216509140133469375"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/RandomStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-4d47cb78",
"digest": {
"length": 745,
"function_hash": "272849820871547730465903666605561691990"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibInStream.cxx",
"function": "ZlibInStream::decompress"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-53ef6632",
"digest": {
"threshold": 0.9,
"line_hashes": [
"177579537529685849852762957441060237004",
"251933355402479177575484550005218941855",
"334142505775676525596020740672315743213",
"312098616113866702466715658618554917495",
"314754265815176559916362137441332710652",
"94337322520692837366895186074775548057",
"84145662523002800551046152532766693804",
"52032960419181984718450711484057672799",
"167732120373913365690323579256952775345",
"72559663738727103022018630404253710102",
"332991449315228310620353589148435638300",
"303668364192849281103870522854063061700",
"167306218040869235000002783762038743134",
"280385995088980768248605263947499785581",
"59905929024762835972252072663246935331",
"200299596743159815846530123158987263021",
"219535758553365428101163363601515158341"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/MemOutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-56ab8a31",
"digest": {
"length": 614,
"function_hash": "169564235586591689781946629146917875559"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdInStream.cxx",
"function": "FdInStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-59e0bad3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"49820052077702581878469069739980670385",
"94156483537904314085950802311690480898",
"206993358059682949104961928937422642231",
"89192942703052583085394002602884190192",
"334279502896597651536743047482504744636",
"233579182997492074356690230629768662867",
"246601865547124646129787809797881788738",
"42674250658728454018729065005827509395",
"223016552181629407884379609889966625402",
"270623521044046391938049889620538196088",
"61282927025559215620829627214171834355",
"219228784244828759869431890842108571192",
"213431888477630097374178563937081162108",
"112232543414159540505164079477626901945",
"213775250860192982970861237711751041609",
"267096055558893467250036606077080749191",
"288024464959098256635530575373792071049"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rfb/Configuration.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-60ce878a",
"digest": {
"length": 248,
"function_hash": "159951959510255395578426075878279297320"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSOutStream.cxx",
"function": "TLSOutStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-60e6fa34",
"digest": {
"length": 438,
"function_hash": "9798376584529021235021910931790820932"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibInStream.cxx",
"function": "ZlibInStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-67aa8684",
"digest": {
"length": 556,
"function_hash": "168115119348669054427227869220138178593"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdOutStream.cxx",
"function": "FdOutStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-719ec4ed",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42449687987089470028347353499402386160",
"76465628976239338282623539195408032353",
"255665966408326362669646498200699683771",
"264913801267804087576780729688033155646",
"132044447853739146636517049675994544733",
"241286130806937597780417154285539400713",
"217788736226453618830645904512589079515",
"158539480609815855526199006670478051271",
"44856114332759567777897307071807903307",
"298607795903557016543168659821576671016",
"192334748311259492750613908144031685827",
"82455621732951292783422314914247566111",
"142873883184615455298169170753302623405"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "win/rfb_win32/Registry.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-72ece14a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315184717482651701645419234782987154636",
"299683287632664212717599899155413457494",
"147092084308930678010078671290670261945",
"218590367195400741445370575296725178715",
"196559995089560990898296069826546588143",
"246160866459221633190374911855720616812",
"200926422505233569868118239018912143201",
"335421014028564846981372261966385901043",
"51472001110237792386066046118375548488",
"12515686289011423811794596856627085531",
"264994556571339947655884383265703522011",
"208633382631703966545532927566138306553"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rfb/Configuration.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-85a800a3",
"digest": {
"length": 689,
"function_hash": "139299055174982695705865515611735905090"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibOutStream.cxx",
"function": "ZlibOutStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-85eb6e18",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181134917670105810401917974479712695743",
"274572076693858098751720880613218696676",
"338276816310553535326744607798851849324",
"168818627281566319575216897046890644155",
"68421862311427692212478878786001703328",
"305694783868041129816019608282355920318",
"129957949971115052986523751643760338953",
"8626154635546625737305408415045558412",
"223574652243720535135435395268088990894",
"141869544392311958780064045100409608340",
"292398563965702935880224089715933706692",
"209513998575142364626135946195038965060",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FileInStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-87201581",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173127357490404860596597673501715113239",
"254449593057053504664443124245913831913",
"98026912827095348779277124635420062368",
"55895345219797657937095289808664281246",
"23464746073661501334380872104879054499",
"64522600042038607001052206866043520258"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FileInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-8b5c35f0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"271884166192777425476245067128043508382",
"107127158925649102453036501685928157916",
"202845177030219201003644804268338642290",
"184009327038671979005456982737541910732",
"101018747099657903902099371383068844811",
"334216474989776816718359404081902847152",
"26735819770651104918782618570645029308",
"128491333250625699057004816757996177196",
"143646429635827027245177576541217181448",
"193544512158480235053067310780216222481",
"193510614077381692067154015819262635749",
"207241873558277972345567976172712716052",
"23832432236243166875273753513770485624",
"269141020527904321076488179358051757386",
"272935596348666033302162093760339694706",
"225824579116461895907308898978699497169",
"8301999833420204489003554268527464808",
"105421517392978127536458321675814229244"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibOutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-9109c592",
"digest": {
"threshold": 0.9,
"line_hashes": [
"183753371682960204280094590822388245117",
"111403505230948686493257824552642595864",
"309848122667473506197450778762500120237",
"174600415163003855828465659034314643757",
"334815753778335830177244511474387048972",
"335633936306424998971099713394046680828",
"282914274552207977792906178569750722753",
"231397997542467541848835546174755820789",
"70802351837982021706736809869268201028",
"17431613834979787385492976777821645593",
"312893002471006302223286303375861505064",
"236618785468531367538255274901110343062",
"330278831212294124812383472803525544632",
"311672052559424253915835019238172444775",
"244864257232940396451641334752998521038",
"31737449090469083808582034595699883830"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexOutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-945cf32c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"172711222193542061474663984043580241833",
"130439790010765780649288581504657222479",
"272106721721997983821672706975178174211",
"149202835638061227529522116532309582062",
"110943166286679222657094180009031392696",
"292730054377076254288947449038753226294",
"117943215793774610075292049478380924192",
"238917332329114384489526549822517010838",
"174446913348460179277555910100713028000",
"115899007553806176471798813987497482489",
"310324030347160883234525566821779960142",
"75122151126553769862511033595613304674",
"284456532436848007959950333382179027252",
"181787690481930975720086099949004763773"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSOutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-950f96d8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50330095558005703718604525978075009244",
"263998414093549841280687384503855873272",
"281565342169282148230319349395897235999",
"154349988712923310154071747924471511033",
"41904161211176610655142752929331206385",
"283802906168955765344293538373039473685",
"311637583259459328210574088260402821000",
"197376635119339865853207185516903444421",
"153262646512544866026611678735266808843",
"140173354044379977107474672918588081776",
"236705046416846214933863012436787093956",
"296463196464257477349007828387049047911",
"94357262625707583880429608380330671912",
"300704117188960956315507350539544476851",
"158364742455538034116512685982801899258",
"48153977372198544060240508353880512689",
"236201557351309190895688523735189707386",
"257447972094829090069567764880002336284",
"75648805341673667062510627250825863527",
"114813677803186160201593591687937943226",
"170223928538941132877098758214712341202",
"44984906225895524450560819868018952359",
"332059604604788322988532937147456387358",
"267590795915375670627850047622753997247",
"212108742510247607458506178968337277630",
"169686510911939435399444570625422167769",
"220086071742693846156419019716704403349",
"272057776058860661239074235204932877590",
"253899684915193196710870496972327455558",
"96232379432223401032353585915432848734",
"177860196844944813533126981525484431993",
"96539247870441572518314635534430454092",
"235693600988510204554369462234688107365",
"324777364513798120726620940499615069949",
"274523284060670660266363961808419530581"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/OutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-a1cddd5b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255900125819808381606992543329501482945",
"108932804014632530882438799381931667146",
"279894465143357704518979246967914322230",
"234570600349534754498077818577399073140",
"278922080296557124808947419222554824635",
"231676933419379467268096951776100833264",
"678409188392986179743325649151292333",
"213327367557298553729707019008786942079",
"188436949170197727440918793037595975476",
"16033755905141087771431180457485800816",
"62160878770743095339434317391066691987",
"285913150520093570410678983589636863860",
"204568464836146455647824196970852496822",
"230495707946208492665510137902634557690",
"242948138653536389210681404725528524912",
"23503891406309967912929705077922995388",
"191777005761433128929594347276544060185",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "tests/perf/encperf.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-a2323b8a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"228955984815588041172878729718975830770",
"55360758691954933263318096777237202497",
"27511760897068558797036441237908176894",
"311348846038392987464505895079046249405",
"294476844529136919447523791113389534190",
"47167325426126351930642375458465201184",
"58036253917486808339086975913734728142",
"17938454599718343251410140505272222097",
"212768616126798661422607202975216899759",
"113568834310544574804167416607103053184",
"37059001850999746395631745748663447120",
"250568808670537519649511848320504384138",
"161416118886358728713821058063261553632",
"245621675423049767745529607951907687865",
"165563756405266572678363387425914994750",
"8093173619958996428902119859896866551",
"304185567764844215658047222756835026888",
"61668440442460348707555834403918165858",
"245789594835487581702489832348371617286",
"238294349266529919492762734446269231891",
"23168805790092088410302971531484169538",
"214845015852078614339069768519563873194",
"195168899310910915682154824469001889285",
"145362978202128322250834573758331173906",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/RandomStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-ab1ece35",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253501134721857775161576002075963918655",
"99774816916784722437150081428060669564",
"318744023154622405394344412734348227524",
"61294013071648342817785168608795893918",
"152276980643914067823822930298802349232",
"107335378876883230222270295916799396330",
"88927376978434121413341896730137395361",
"195013129915170126633326353605092398120",
"198084346945684989856875546866440758673",
"164361389422679131664812147069924632062",
"166540394080638981925899433520976419873"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/MemInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-abf8ed31",
"digest": {
"threshold": 0.9,
"line_hashes": [
"324688892611763723364667904539565078566",
"250959680269962981387970801261510544979",
"254620846712248164862606175147996782451",
"278659910778963748016987632426498395370",
"29102859418829158422256568313802224260",
"225380142667160134887444446408356374544",
"259305001647031133846530437860500596431",
"316322099756267704650834024230475801749",
"339017124063030203818546684528479400528",
"75923846271283424586241159014358390572",
"190183556694108224951719818187660560309",
"31303424427902347930382296991543840950",
"89254079204854880676949988962747534620",
"214784222123846976030901284718630611643",
"305429497540421196588732047000713911968",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997",
"297503065999951940271625960467431520215",
"72315250185711741559785883110062756945",
"140536051988166172596117144362757178135",
"308236745186753273179463362447528972915"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSInStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-af28e0ab",
"digest": {
"length": 248,
"function_hash": "307945796967129203745834684453328153221"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexOutStream.cxx",
"function": "HexOutStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-b155fc83",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114102340865558773416411847595732220631",
"323192537369871770047504175441022509870",
"149334639245517920384426153931201911580",
"179287477312691879389080813326871573116",
"337693008091092446807970038167290684662",
"322050225799984102991108698443796817886",
"161373825560134017686034794637628835899",
"263905460671097762155762805465463550355",
"188587329200549222385000841761741914806",
"301496347741176840981006242870115409174",
"288127201168581257729581662196019198262",
"309275365765969952029768473407172486629",
"285890633998452435411539632278488910642",
"15095042831125698481008562687750393778",
"14754408034116091195954295255626999496",
"313151002710879258376308028485956593132",
"111491088036571962230824818880045868173",
"25985718380490878546506583604366598357",
"68348739047932448241423520651858752632",
"238393696976190904025788658717158497628",
"123958769880057662381603650305973204216",
"282253162472916082868913261170235545676",
"113341586451748688420096668836473000357"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-b233c089",
"digest": {
"threshold": 0.9,
"line_hashes": [
"220184421206649530284960660809718491611",
"192987308041528188710585274869755316186",
"72008714694285004693490374432359564087",
"218565612389602430705093429995457336107",
"103054043922091573349842940819720282372",
"171402155734821577924724796504885289633",
"127026687317932214858165333456171415703",
"74157967318812253700449775593760874421",
"55556351628931953603663995913475617927",
"286970277521821243764281312788195401993",
"154451378534680692088821109304257784291",
"236705046416846214933863012436787093956",
"296463196464257477349007828387049047911",
"94357262625707583880429608380330671912",
"15078124363930819823640023068268357955",
"314256328820317340339554460600550400795",
"74310775499884657208859512513342544531",
"49445433828289766031203164175836953716",
"45582057017432896526786716940532449251",
"310657513628157461238966070566037355972",
"157909593649011470209820010738154184909",
"212803938238151251610543837027465563167",
"338943194467666733263575483246473429036",
"175457676935645172822796458119757930742",
"14819772330874784616051307808262967896",
"146810523307166124580682979097881065459",
"141106661579779299584686269934482573777",
"15698425493719220719005752400966801075",
"239422043290859130903111472093943895717",
"60635420708439818325305053191120584474"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/InStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-c2ec5fc2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"61356708877490963278430394856301256986",
"115546687480688584142861205446899651924",
"177717215387938240589925019714176133779",
"150353882902066452697621239971419585577",
"150807296982881071905120459165725761481",
"14952024636272712508365323033724447899",
"45107993556600006421170555624587509393",
"283589775742988973454126018467972942779",
"117656837935975444967036806369061327980",
"263862032647793936715491571756381536085",
"282253162472916082868913261170235545676",
"314389881963263288616157554699888621247"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-c5dc5490",
"digest": {
"threshold": 0.9,
"line_hashes": [
"263136933199142176665947797634985036241",
"43782460373961251946548643284357260096",
"118860421099896038272699137334316904282",
"251651053035906649054492577023764157052",
"337233654744222975223165251756938436411",
"356691806925193960585495944442678044",
"11926443455298535924528448872196460923",
"54878773053547854638191276193245157036",
"119106915877404894396252697667625678079",
"262499663026860948175825016003028967919",
"144832924834222780435033795553805363007",
"197147275070860091040634922879446435845",
"240757757653746330634415896688112435835",
"92589677381841694929511290249165126812",
"106025249322933195897436507521409600138",
"74413089739035483547569881161092600025",
"174727164953706417210356344712611560184",
"132260158850715118350497830313035979089",
"206351487681908351515076966745436459533",
"185498271650644722239267816816349231220",
"212589535540714223714154776375301855835",
"102072937664792310628216865311968564729",
"166481479849556854691964797377680785799",
"330834775607121945603563866643579859602",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997",
"107220588200419539895305081977174189731",
"322364997346822372893111999470681863793",
"153273615016943160977115135503631944347",
"10564009442378406205775788262421354148",
"304233066223172049401377920498141531132",
"90598644972166047839364447286627969070",
"270869628838658077206435746062043811079",
"335093176986560413503186195756462056150"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibInStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-d3363e84",
"digest": {
"length": 626,
"function_hash": "156275301587783473724916900286424849741"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FileInStream.cxx",
"function": "FileInStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-d9e2d1c2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56989988930245285192505948419368843985",
"133264107597908662028183063933286320565",
"252594149996455983436659131348995226732",
"198293599921955708067744181291114805197",
"15769105222886409218774774640693833766",
"83539448811215626163025568903838198018",
"68050412224475200740173271545871436158",
"65723943626121336605739409180257981232",
"137642103218420475737588002711818183047",
"91781338827705861263123689799712109542",
"3831964366197414207743426685598465863",
"105291856106228425625267080471250837133",
"155013483754350623838942911371175080478",
"13617493408477274332456545893605327796",
"38259344092797269800158533661632396434",
"71819308716303688258892784120872766032",
"234242102386843410730213211154119122828",
"317994120661705498649433435906230892538",
"64558849797973411920383334619737682682",
"216400217006093637638149646752134323145",
"243611542643712251903092590327700441923",
"826412970119657874404674476267320111",
"189424456006591834338823324535801300731",
"220768429243900188572583891018116245030",
"94014836033794948248630592557476145063",
"36306156508144273625278694343641617716",
"247726330974232301723879228993118162354",
"99531853097378675089794806891850548198",
"327962237193124745586532782378166662438",
"331570734182899450614218383734744839239",
"76502301406642611728918049752971007538",
"208680863514203253434909190911455371893",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexInStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-e0d96be1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"213163121732355196921424969925775671459",
"255981708554079827562412335294230800596",
"267479130401152161455888921440249451180",
"232498186965364092624222386381035749277",
"233460390941220766447292276744984595746",
"126223487871553640309032794727471630140",
"337819690102538020895941071998168000082",
"93479547401843208097539934542507650660",
"82626930530554861393688467963165318783",
"166563642691570939224114194867081559891",
"94467247747336437229215770385192793072"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rfb/Password.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-e1ac00c5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"86153470115623505115282882597818477960",
"239119893850857190721315518671670802657",
"64780910230135001109157376701555117497",
"208591168343523892166391304684773676811",
"97277087059989945979211178020583050766",
"154335651189442705018947260927524438850",
"245159534876677905304064299315078231555",
"325135237963125977775183474121756499630",
"319539147531829681995145328131118386402",
"125675428458837668118424823231192259794",
"158702166203543532475908436286526857725"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rfb/Password.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-e3230df5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"39537199480895378036505838348367986284",
"183112361292991625588548295530315216029",
"268374758256240820403745486388451316051",
"15322614484306783194009337302520125433",
"145974858269722444005555659208834483694",
"299829466654238297018306953032510933123",
"65732914911489001079548557409324709397",
"81065166061284036845960167523512234585",
"218721205158170119703174337090504141613",
"330826316073016422730927825581585330065",
"37300962676971163183333810882688932319",
"74048503333392723318326904893956974369",
"264381595522092330403639233519224161959",
"65975232261253023128976077859391586792",
"149717971985008539329103537071855343758",
"263386191230596399115676251095030140170",
"140147879702964656414849409592917055688",
"54658750562614253524947155466461639177",
"184130168993381845075699902620802240658",
"23035200912669670467083814931289105085",
"80707485653500841402042036041282219496",
"207859768579055782065919111168459688341",
"180381480336575448870194513683591347353",
"105399605271226671673928792561591444248",
"13004238084137308331881825704640013414",
"54385901913409429483531573144282472358",
"170643408489420711564903735346511234425",
"139947011315358904892775079160356612306",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexOutStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-e8fef214",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120166164348383143469912392326431777020",
"324493862052718622697607842665329519015",
"144254133236882455132839370309569547441",
"185864824537239923366625777453762636592",
"205139885943211760775257280361751812996",
"223421027871055937926552192573612928180",
"317463739330475400162791835633317136529",
"257486125568756543333950481114788225962",
"86278354407188374245921149537867259414",
"154855432456457085329854307359095841068",
"35568803765299978424967350390525742937",
"261040660444529035317248547943852125196",
"9153627498380683802348275763585736140",
"214687754164476475543225539468426265064",
"288850291653178849972385968723117812629",
"298822043767366335243141485385191596255",
"48499556637714824245597102797447253878",
"6208060487310465084273187815814510990"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/FdOutStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-ea2822e1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244898307285607222563950983609948346553",
"43341883940359034701178509634248810808",
"22408825226224875324426357928765543832",
"60530162050125679653946289113577625063",
"76107314312341759972938036182515678925",
"18495751838936931870568384318138527877",
"61931596568621288510154184647743829985",
"253823076434691330261062532092873277700",
"254225327870488393069051522463336618036",
"159301435689726407364870564697366360066",
"85589509358529502174652398297687461958",
"27733562361413048841963154418597428512",
"267145303541782909907947673219714351786",
"323141724127020486172182574447184703104"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/HexInStream.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-f7c1772a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"788418275041876144104071365232394748",
"55158404610862932387061218103938622375",
"216517420909707281243634226871702905505",
"251654775379643296845609202287505515505",
"242898085802677864879924569630847969573",
"276135911889755914078004098902569028802",
"151024028086634517976279733000052360909",
"82965866617931834765639636394134776902",
"54670713426665813214826927107117377423",
"76258152986686058292984201441017210397",
"252080884080013982449501210697398693142",
"35458292050147967809376086973913052176",
"152350664892770783519354561765572695886",
"116246027747354098453836863570974272666",
"74440812529400276484563510483358711542",
"327250220345204538334784903628094393972",
"112323667358162469976394223551032062881",
"228137293814496458159979232211716871075",
"330082145924503145553009562963831210222",
"232111282591450778276508934925926156997"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/ZlibOutStream.cxx"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-15694-fde2eeca",
"digest": {
"length": 525,
"function_hash": "87762286769633400919795729447345962908"
},
"source": "https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"target": {
"file": "common/rdr/TLSInStream.cxx",
"function": "TLSInStream::overrun"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:55:31Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/tigervnc/tigervnc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4739493b635372bd40a34640a719f79fa90e4dba"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.10.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4739493b635372bd40a34640a719f79fa90e4dba"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.10.1"
}
]
}
}
],
"versions": [
"v1.10.0",
"v1.9.90",
"v1.1.90",
"v0.0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15694.json"
}
}
],
"modified": "2026-10-20T13:55:31.675971895Z",
"provider": "osv",
"references": [
"https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1",
"https://github.com/CendioOssman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438",
"https://www.openwall.com/lists/oss-security/2019/12/20/2"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-15694",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388381,
"published_at": "2019-12-26T15:15:11.337+00:00"
}