TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Reference and upstream commit: https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40
Created tigervnc tracking bugs for this issue: Affects: fedora-all [bug 1789909]
https://github.com/TigerVNC/tigervnc/pull/921 As per upstream " All issues require a successfully authenticated connection though."
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1497 https://access.redhat.com/errata/RHSA-2020:1497
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-15691
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3875 https://access.redhat.com/errata/RHSA-2020:3875