{"id":"CVE-2019-15694","details":"TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.","modified":"2026-04-16T04:35:02.609400855Z","published":"2019-12-26T15:15:11.337Z","related":["SUSE-SU-2020:0112-1","SUSE-SU-2020:0113-1","SUSE-SU-2020:0159-1","SUSE-SU-2020:0266-1","SUSE-SU-2020:1749-1","openSUSE-SU-2020:0087-1","openSUSE-SU-2024:10591-1"],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html"},{"type":"ADVISORY","url":"https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1"},{"type":"FIX","url":"https://github.com/CendioOssman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438"},{"type":"EVIDENCE","url":"https://www.openwall.com/lists/oss-security/2019/12/20/2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cendioossman/tigervnc","events":[{"introduced":"0"},{"fixed":"0943c006c7d900dfc0281639e992791d6c567438"}]},{"type":"GIT","repo":"https://github.com/tigervnc/tigervnc","events":[{"introduced":"0"},{"fixed":"4739493b635372bd40a34640a719f79fa90e4dba"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"1.10.1"}]}}],"versions":["v0.0.90","v1.1.90","v1.10.0","v1.9.90"],"database_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["311598666017041075854840215659579403669","269078340988576390873214762699109418917","1828546582398084752010188458714278173","19919295865579185429183147363928091644"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rfb/util.h"},"signature_type":"Line","id":"CVE-2019-15694-0bfa25d9","signature_version":"v1"},{"digest":{"function_hash":"53365734544241902038890594750217277871","length":979},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Function","target":{"function":"RandomStream::overrun","file":"common/rdr/RandomStream.cxx"},"id":"CVE-2019-15694-10ac2cc8","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/ZlibInStream.h"},"id":"CVE-2019-15694-114f5767","digest":{"threshold":0.9,"line_hashes":["180124185349625532223066568424718232966","179616192323364511610720996756045880428","16584269604604038072734221904726607238","318947165258731905289930245013781284590","61821847763961388761352671313281822587","108664684633731033808731281586981037574","233991859924988536612159427661257895873","234608700770937511980538456558404500518","61881996884287099804972689811368920821","253571620117286683787177667477747420171","39372851218898380150466779854840343898","114101300490435070298614353094966462430","102935837819193458749451387166207867538","193960071455421712514699818098667492547","254241238868873589210748370677936619916","258084985038955342567817060433442017001","276112720315526178871342918614968892198","133009061574878650333733987919427179190"]}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/TLSOutStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-1331cc5f","digest":{"threshold":0.9,"line_hashes":["328717684117144887185469299313430717507","314209661762549758000212546228713783800","64225417089128373134628771208243589062","209676732379503000399595186400383084941","251803333918230122478245468583075328347","12005430807026892274384504126840518178","269120689213011573625401191312074551578","92002302527214785617610467023914458719","312776925776183088925506755206450347913","250421171256381384524523096026282216235","308027022213979392859674050744757048715","310627813914984905034755179306137287878","110262423099119989182697264183608941902","311189570801243443388184636961581751331","207599128141034429536320952988112017535","191777005761433128929594347276544060185","232111282591450778276508934925926156997","214259066992595256318519476723316223283","111555706349026741974109906905363876401","143228689660597205511078571039618140355","167770164802817375710647931392489046955"]}},{"digest":{"threshold":0.9,"line_hashes":["69793656717310463674640305268808304168","91947087622627896289314664098227549067","65232604713415907220110866938586710547","179896259442894048142803320304249123809","274571916785126300182665764249003004908","237476717238198436138378743031744372771","144844418758744162861763562536397910895","156855654021995595857708391797154413341","167685207350421184377348440022434530319","258555689971379539277472978895537480558","105702098976378447293694643207319458080","38287393330885531036164770161874613643","125989221054494078515747762660520531131","235727160204384019504710177397071548308","145693557058584056011984568771595677944","214213192044660418069072243726201633835","7851918672379023761553015807710331999","86482715052746973815825821395828794042","18171819995982907179236426240211350197","68122059487515959808629726426095957756","116213261666766818994158737611804175093","105430076459779583605915203935078645481","258181824916261776365368018148112825974","106049802199956291321714796597164374203","298129102028360239758945650813357964143","140167372207471910220620239791622500218","192189694713213321899398061219284388399","29678474713659706226847579755512553177","87472591540829846168772106745607125585","878366372498132726676001595404101648","294623677796087169748585800756836401244","159357207374540109968871008366665114571","209998587867419728528968067877208817397","305429497540421196588732047000713911968","330082145924503145553009562963831210222","232111282591450778276508934925926156997","104514500238732893537535598494722673620","80046177733237847910553060511967930608","293252368160258809076618100083957667627","254709268907262906810842092282203741368"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/FdInStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-16843a7b","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["268640148340531277896574409077737591752","313457341295742025200235747942188398304","268725475865432573234886604303391089482","260121520990603886808131758990433300882","275692798203705761915947666676129600403","100815701349490666172817321628431096154","318732625325733733288593029159732469066","262220762078756918193187460742680342370","232651885134133701589821051842930464412","198056916689628914712145005204404951961","41351851371112405459621932788764114085","319542336057733926353925869210419378466","308257205924958904343168570877413583234","121354582152715180645503079221159803466","327866475121707879889385392102477594558","244444786174270366923303736523173968543","109411159785153605178927968121428480248","18611198680331023027662372442254381908","161044162470258601011537841424521877620","30520579385772338558346168905997622432","144159655586310837620939110079500500475","228970359307372173059698035635972754941","276045892784981726110468017735193920444","7638937581798650741883730587886267184","228137293814496458159979232211716871075","330082145924503145553009562963831210222","232111282591450778276508934925926156997","218609120963872124491496712430194427322","5825371639267421460624296666167553349","140710486739892172925480677180073574985","273869871393202692402148464761686487529"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/FdOutStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-1fecc054","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"DummyOutStream::overrun","file":"tests/perf/encperf.cxx"},"signature_type":"Function","id":"CVE-2019-15694-2bc31e78","digest":{"function_hash":"240125044736488558608346733437849059974","length":160}},{"digest":{"function_hash":"301583659804354913963397677921718786323","length":882},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Function","target":{"function":"HexInStream::overrun","file":"common/rdr/HexInStream.cxx"},"id":"CVE-2019-15694-3acabd26","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"win/rfb_win32/Registry.h"},"id":"CVE-2019-15694-3c59942e","digest":{"threshold":0.9,"line_hashes":["103803959313158531927962339863683708380","161717359440526906122547532493707236330","256635271931092041500639717728628994222","85623057982273318179755298144604449752","215168736530461362376662872157357814342","85811419895922922385833331966125523520","183074475327487877115968824181465263440","60212908821143655389460432794620098905","40971903096055332930941605357586499199","112024064971389857010021716835325334449"]}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/RandomStream.h"},"id":"CVE-2019-15694-4216d915","digest":{"threshold":0.9,"line_hashes":["79944389184895293536731598002789735701","178740628494402811537938334424460365484","7785674455617877984375619559980760129","226347489110728221782817235783791887276","78251406796619045711986039569154037270","265037659978660194624523071072685954579","66197770443879629629033412155173022292","291550906526242910475642293551342667133","132391428378767741918216509140133469375"]}},{"digest":{"function_hash":"272849820871547730465903666605561691990","length":745},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Function","target":{"function":"ZlibInStream::decompress","file":"common/rdr/ZlibInStream.cxx"},"id":"CVE-2019-15694-4d47cb78","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["177579537529685849852762957441060237004","251933355402479177575484550005218941855","334142505775676525596020740672315743213","312098616113866702466715658618554917495","314754265815176559916362137441332710652","94337322520692837366895186074775548057","84145662523002800551046152532766693804","52032960419181984718450711484057672799","167732120373913365690323579256952775345","72559663738727103022018630404253710102","332991449315228310620353589148435638300","303668364192849281103870522854063061700","167306218040869235000002783762038743134","280385995088980768248605263947499785581","59905929024762835972252072663246935331","200299596743159815846530123158987263021","219535758553365428101163363601515158341"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/MemOutStream.h"},"signature_type":"Line","id":"CVE-2019-15694-53ef6632","signature_version":"v1"},{"digest":{"function_hash":"169564235586591689781946629146917875559","length":614},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"FdInStream::overrun","file":"common/rdr/FdInStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-56ab8a31","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["49820052077702581878469069739980670385","94156483537904314085950802311690480898","206993358059682949104961928937422642231","89192942703052583085394002602884190192","334279502896597651536743047482504744636","233579182997492074356690230629768662867","246601865547124646129787809797881788738","42674250658728454018729065005827509395","223016552181629407884379609889966625402","270623521044046391938049889620538196088","61282927025559215620829627214171834355","219228784244828759869431890842108571192","213431888477630097374178563937081162108","112232543414159540505164079477626901945","213775250860192982970861237711751041609","267096055558893467250036606077080749191","288024464959098256635530575373792071049"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rfb/Configuration.h"},"id":"CVE-2019-15694-59e0bad3","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"TLSOutStream::overrun","file":"common/rdr/TLSOutStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-60ce878a","digest":{"function_hash":"159951959510255395578426075878279297320","length":248}},{"digest":{"function_hash":"9798376584529021235021910931790820932","length":438},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"ZlibInStream::overrun","file":"common/rdr/ZlibInStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-60e6fa34","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"FdOutStream::overrun","file":"common/rdr/FdOutStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-67aa8684","digest":{"function_hash":"168115119348669054427227869220138178593","length":556}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"win/rfb_win32/Registry.cxx"},"id":"CVE-2019-15694-719ec4ed","digest":{"threshold":0.9,"line_hashes":["42449687987089470028347353499402386160","76465628976239338282623539195408032353","255665966408326362669646498200699683771","264913801267804087576780729688033155646","132044447853739146636517049675994544733","241286130806937597780417154285539400713","217788736226453618830645904512589079515","158539480609815855526199006670478051271","44856114332759567777897307071807903307","298607795903557016543168659821576671016","192334748311259492750613908144031685827","82455621732951292783422314914247566111","142873883184615455298169170753302623405"]}},{"digest":{"threshold":0.9,"line_hashes":["315184717482651701645419234782987154636","299683287632664212717599899155413457494","147092084308930678010078671290670261945","218590367195400741445370575296725178715","196559995089560990898296069826546588143","246160866459221633190374911855720616812","200926422505233569868118239018912143201","335421014028564846981372261966385901043","51472001110237792386066046118375548488","12515686289011423811794596856627085531","264994556571339947655884383265703522011","208633382631703966545532927566138306553"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rfb/Configuration.cxx"},"id":"CVE-2019-15694-72ece14a","signature_version":"v1"},{"digest":{"function_hash":"139299055174982695705865515611735905090","length":689},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"ZlibOutStream::overrun","file":"common/rdr/ZlibOutStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-85a800a3","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["181134917670105810401917974479712695743","274572076693858098751720880613218696676","338276816310553535326744607798851849324","168818627281566319575216897046890644155","68421862311427692212478878786001703328","305694783868041129816019608282355920318","129957949971115052986523751643760338953","8626154635546625737305408415045558412","223574652243720535135435395268088990894","141869544392311958780064045100409608340","292398563965702935880224089715933706692","209513998575142364626135946195038965060","330082145924503145553009562963831210222","232111282591450778276508934925926156997"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/FileInStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-85eb6e18","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/FileInStream.h"},"signature_type":"Line","id":"CVE-2019-15694-87201581","digest":{"threshold":0.9,"line_hashes":["173127357490404860596597673501715113239","254449593057053504664443124245913831913","98026912827095348779277124635420062368","55895345219797657937095289808664281246","23464746073661501334380872104879054499","64522600042038607001052206866043520258"]}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/ZlibOutStream.h"},"signature_type":"Line","id":"CVE-2019-15694-8b5c35f0","digest":{"threshold":0.9,"line_hashes":["271884166192777425476245067128043508382","107127158925649102453036501685928157916","202845177030219201003644804268338642290","184009327038671979005456982737541910732","101018747099657903902099371383068844811","334216474989776816718359404081902847152","26735819770651104918782618570645029308","128491333250625699057004816757996177196","143646429635827027245177576541217181448","193544512158480235053067310780216222481","193510614077381692067154015819262635749","207241873558277972345567976172712716052","23832432236243166875273753513770485624","269141020527904321076488179358051757386","272935596348666033302162093760339694706","225824579116461895907308898978699497169","8301999833420204489003554268527464808","105421517392978127536458321675814229244"]}},{"digest":{"threshold":0.9,"line_hashes":["183753371682960204280094590822388245117","111403505230948686493257824552642595864","309848122667473506197450778762500120237","174600415163003855828465659034314643757","334815753778335830177244511474387048972","335633936306424998971099713394046680828","282914274552207977792906178569750722753","231397997542467541848835546174755820789","70802351837982021706736809869268201028","17431613834979787385492976777821645593","312893002471006302223286303375861505064","236618785468531367538255274901110343062","330278831212294124812383472803525544632","311672052559424253915835019238172444775","244864257232940396451641334752998521038","31737449090469083808582034595699883830"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/HexOutStream.h"},"signature_type":"Line","id":"CVE-2019-15694-9109c592","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/TLSOutStream.h"},"signature_type":"Line","id":"CVE-2019-15694-945cf32c","digest":{"threshold":0.9,"line_hashes":["172711222193542061474663984043580241833","130439790010765780649288581504657222479","272106721721997983821672706975178174211","149202835638061227529522116532309582062","110943166286679222657094180009031392696","292730054377076254288947449038753226294","117943215793774610075292049478380924192","238917332329114384489526549822517010838","174446913348460179277555910100713028000","115899007553806176471798813987497482489","310324030347160883234525566821779960142","75122151126553769862511033595613304674","284456532436848007959950333382179027252","181787690481930975720086099949004763773"]}},{"digest":{"threshold":0.9,"line_hashes":["50330095558005703718604525978075009244","263998414093549841280687384503855873272","281565342169282148230319349395897235999","154349988712923310154071747924471511033","41904161211176610655142752929331206385","283802906168955765344293538373039473685","311637583259459328210574088260402821000","197376635119339865853207185516903444421","153262646512544866026611678735266808843","140173354044379977107474672918588081776","236705046416846214933863012436787093956","296463196464257477349007828387049047911","94357262625707583880429608380330671912","300704117188960956315507350539544476851","158364742455538034116512685982801899258","48153977372198544060240508353880512689","236201557351309190895688523735189707386","257447972094829090069567764880002336284","75648805341673667062510627250825863527","114813677803186160201593591687937943226","170223928538941132877098758214712341202","44984906225895524450560819868018952359","332059604604788322988532937147456387358","267590795915375670627850047622753997247","212108742510247607458506178968337277630","169686510911939435399444570625422167769","220086071742693846156419019716704403349","272057776058860661239074235204932877590","253899684915193196710870496972327455558","96232379432223401032353585915432848734","177860196844944813533126981525484431993","96539247870441572518314635534430454092","235693600988510204554369462234688107365","324777364513798120726620940499615069949","274523284060670660266363961808419530581"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/OutStream.h"},"id":"CVE-2019-15694-950f96d8","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["255900125819808381606992543329501482945","108932804014632530882438799381931667146","279894465143357704518979246967914322230","234570600349534754498077818577399073140","278922080296557124808947419222554824635","231676933419379467268096951776100833264","678409188392986179743325649151292333","213327367557298553729707019008786942079","188436949170197727440918793037595975476","16033755905141087771431180457485800816","62160878770743095339434317391066691987","285913150520093570410678983589636863860","204568464836146455647824196970852496822","230495707946208492665510137902634557690","242948138653536389210681404725528524912","23503891406309967912929705077922995388","191777005761433128929594347276544060185","232111282591450778276508934925926156997"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"tests/perf/encperf.cxx"},"id":"CVE-2019-15694-a1cddd5b","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/RandomStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-a2323b8a","digest":{"threshold":0.9,"line_hashes":["228955984815588041172878729718975830770","55360758691954933263318096777237202497","27511760897068558797036441237908176894","311348846038392987464505895079046249405","294476844529136919447523791113389534190","47167325426126351930642375458465201184","58036253917486808339086975913734728142","17938454599718343251410140505272222097","212768616126798661422607202975216899759","113568834310544574804167416607103053184","37059001850999746395631745748663447120","250568808670537519649511848320504384138","161416118886358728713821058063261553632","245621675423049767745529607951907687865","165563756405266572678363387425914994750","8093173619958996428902119859896866551","304185567764844215658047222756835026888","61668440442460348707555834403918165858","245789594835487581702489832348371617286","238294349266529919492762734446269231891","23168805790092088410302971531484169538","214845015852078614339069768519563873194","195168899310910915682154824469001889285","145362978202128322250834573758331173906","330082145924503145553009562963831210222","232111282591450778276508934925926156997"]}},{"digest":{"threshold":0.9,"line_hashes":["253501134721857775161576002075963918655","99774816916784722437150081428060669564","318744023154622405394344412734348227524","61294013071648342817785168608795893918","152276980643914067823822930298802349232","107335378876883230222270295916799396330","88927376978434121413341896730137395361","195013129915170126633326353605092398120","198084346945684989856875546866440758673","164361389422679131664812147069924632062","166540394080638981925899433520976419873"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/MemInStream.h"},"signature_type":"Line","id":"CVE-2019-15694-ab1ece35","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/TLSInStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-abf8ed31","digest":{"threshold":0.9,"line_hashes":["324688892611763723364667904539565078566","250959680269962981387970801261510544979","254620846712248164862606175147996782451","278659910778963748016987632426498395370","29102859418829158422256568313802224260","225380142667160134887444446408356374544","259305001647031133846530437860500596431","316322099756267704650834024230475801749","339017124063030203818546684528479400528","75923846271283424586241159014358390572","190183556694108224951719818187660560309","31303424427902347930382296991543840950","89254079204854880676949988962747534620","214784222123846976030901284718630611643","305429497540421196588732047000713911968","330082145924503145553009562963831210222","232111282591450778276508934925926156997","297503065999951940271625960467431520215","72315250185711741559785883110062756945","140536051988166172596117144362757178135","308236745186753273179463362447528972915"]}},{"digest":{"function_hash":"307945796967129203745834684453328153221","length":248},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Function","target":{"function":"HexOutStream::overrun","file":"common/rdr/HexOutStream.cxx"},"id":"CVE-2019-15694-af28e0ab","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/FdInStream.h"},"signature_type":"Line","id":"CVE-2019-15694-b155fc83","digest":{"threshold":0.9,"line_hashes":["114102340865558773416411847595732220631","323192537369871770047504175441022509870","149334639245517920384426153931201911580","179287477312691879389080813326871573116","337693008091092446807970038167290684662","322050225799984102991108698443796817886","161373825560134017686034794637628835899","263905460671097762155762805465463550355","188587329200549222385000841761741914806","301496347741176840981006242870115409174","288127201168581257729581662196019198262","309275365765969952029768473407172486629","285890633998452435411539632278488910642","15095042831125698481008562687750393778","14754408034116091195954295255626999496","313151002710879258376308028485956593132","111491088036571962230824818880045868173","25985718380490878546506583604366598357","68348739047932448241423520651858752632","238393696976190904025788658717158497628","123958769880057662381603650305973204216","282253162472916082868913261170235545676","113341586451748688420096668836473000357"]}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/InStream.h"},"id":"CVE-2019-15694-b233c089","digest":{"threshold":0.9,"line_hashes":["220184421206649530284960660809718491611","192987308041528188710585274869755316186","72008714694285004693490374432359564087","218565612389602430705093429995457336107","103054043922091573349842940819720282372","171402155734821577924724796504885289633","127026687317932214858165333456171415703","74157967318812253700449775593760874421","55556351628931953603663995913475617927","286970277521821243764281312788195401993","154451378534680692088821109304257784291","236705046416846214933863012436787093956","296463196464257477349007828387049047911","94357262625707583880429608380330671912","15078124363930819823640023068268357955","314256328820317340339554460600550400795","74310775499884657208859512513342544531","49445433828289766031203164175836953716","45582057017432896526786716940532449251","310657513628157461238966070566037355972","157909593649011470209820010738154184909","212803938238151251610543837027465563167","338943194467666733263575483246473429036","175457676935645172822796458119757930742","14819772330874784616051307808262967896","146810523307166124580682979097881065459","141106661579779299584686269934482573777","15698425493719220719005752400966801075","239422043290859130903111472093943895717","60635420708439818325305053191120584474"]}},{"digest":{"threshold":0.9,"line_hashes":["61356708877490963278430394856301256986","115546687480688584142861205446899651924","177717215387938240589925019714176133779","150353882902066452697621239971419585577","150807296982881071905120459165725761481","14952024636272712508365323033724447899","45107993556600006421170555624587509393","283589775742988973454126018467972942779","117656837935975444967036806369061327980","263862032647793936715491571756381536085","282253162472916082868913261170235545676","314389881963263288616157554699888621247"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/TLSInStream.h"},"id":"CVE-2019-15694-c2ec5fc2","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/ZlibInStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-c5dc5490","digest":{"threshold":0.9,"line_hashes":["263136933199142176665947797634985036241","43782460373961251946548643284357260096","118860421099896038272699137334316904282","251651053035906649054492577023764157052","337233654744222975223165251756938436411","356691806925193960585495944442678044","11926443455298535924528448872196460923","54878773053547854638191276193245157036","119106915877404894396252697667625678079","262499663026860948175825016003028967919","144832924834222780435033795553805363007","197147275070860091040634922879446435845","240757757653746330634415896688112435835","92589677381841694929511290249165126812","106025249322933195897436507521409600138","74413089739035483547569881161092600025","174727164953706417210356344712611560184","132260158850715118350497830313035979089","206351487681908351515076966745436459533","185498271650644722239267816816349231220","212589535540714223714154776375301855835","102072937664792310628216865311968564729","166481479849556854691964797377680785799","330834775607121945603563866643579859602","330082145924503145553009562963831210222","232111282591450778276508934925926156997","107220588200419539895305081977174189731","322364997346822372893111999470681863793","153273615016943160977115135503631944347","10564009442378406205775788262421354148","304233066223172049401377920498141531132","90598644972166047839364447286627969070","270869628838658077206435746062043811079","335093176986560413503186195756462056150"]}},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"FileInStream::overrun","file":"common/rdr/FileInStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-d3363e84","digest":{"function_hash":"156275301587783473724916900286424849741","length":626}},{"digest":{"threshold":0.9,"line_hashes":["56989988930245285192505948419368843985","133264107597908662028183063933286320565","252594149996455983436659131348995226732","198293599921955708067744181291114805197","15769105222886409218774774640693833766","83539448811215626163025568903838198018","68050412224475200740173271545871436158","65723943626121336605739409180257981232","137642103218420475737588002711818183047","91781338827705861263123689799712109542","3831964366197414207743426685598465863","105291856106228425625267080471250837133","155013483754350623838942911371175080478","13617493408477274332456545893605327796","38259344092797269800158533661632396434","71819308716303688258892784120872766032","234242102386843410730213211154119122828","317994120661705498649433435906230892538","64558849797973411920383334619737682682","216400217006093637638149646752134323145","243611542643712251903092590327700441923","826412970119657874404674476267320111","189424456006591834338823324535801300731","220768429243900188572583891018116245030","94014836033794948248630592557476145063","36306156508144273625278694343641617716","247726330974232301723879228993118162354","99531853097378675089794806891850548198","327962237193124745586532782378166662438","331570734182899450614218383734744839239","76502301406642611728918049752971007538","208680863514203253434909190911455371893","330082145924503145553009562963831210222","232111282591450778276508934925926156997"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/HexInStream.cxx"},"id":"CVE-2019-15694-d9e2d1c2","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["213163121732355196921424969925775671459","255981708554079827562412335294230800596","267479130401152161455888921440249451180","232498186965364092624222386381035749277","233460390941220766447292276744984595746","126223487871553640309032794727471630140","337819690102538020895941071998168000082","93479547401843208097539934542507650660","82626930530554861393688467963165318783","166563642691570939224114194867081559891","94467247747336437229215770385192793072"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rfb/Password.cxx"},"signature_type":"Line","id":"CVE-2019-15694-e0d96be1","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["86153470115623505115282882597818477960","239119893850857190721315518671670802657","64780910230135001109157376701555117497","208591168343523892166391304684773676811","97277087059989945979211178020583050766","154335651189442705018947260927524438850","245159534876677905304064299315078231555","325135237963125977775183474121756499630","319539147531829681995145328131118386402","125675428458837668118424823231192259794","158702166203543532475908436286526857725"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rfb/Password.h"},"signature_type":"Line","id":"CVE-2019-15694-e1ac00c5","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["39537199480895378036505838348367986284","183112361292991625588548295530315216029","268374758256240820403745486388451316051","15322614484306783194009337302520125433","145974858269722444005555659208834483694","299829466654238297018306953032510933123","65732914911489001079548557409324709397","81065166061284036845960167523512234585","218721205158170119703174337090504141613","330826316073016422730927825581585330065","37300962676971163183333810882688932319","74048503333392723318326904893956974369","264381595522092330403639233519224161959","65975232261253023128976077859391586792","149717971985008539329103537071855343758","263386191230596399115676251095030140170","140147879702964656414849409592917055688","54658750562614253524947155466461639177","184130168993381845075699902620802240658","23035200912669670467083814931289105085","80707485653500841402042036041282219496","207859768579055782065919111168459688341","180381480336575448870194513683591347353","105399605271226671673928792561591444248","13004238084137308331881825704640013414","54385901913409429483531573144282472358","170643408489420711564903735346511234425","139947011315358904892775079160356612306","232111282591450778276508934925926156997"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"file":"common/rdr/HexOutStream.cxx"},"signature_type":"Line","id":"CVE-2019-15694-e3230df5","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["120166164348383143469912392326431777020","324493862052718622697607842665329519015","144254133236882455132839370309569547441","185864824537239923366625777453762636592","205139885943211760775257280361751812996","223421027871055937926552192573612928180","317463739330475400162791835633317136529","257486125568756543333950481114788225962","86278354407188374245921149537867259414","154855432456457085329854307359095841068","35568803765299978424967350390525742937","261040660444529035317248547943852125196","9153627498380683802348275763585736140","214687754164476475543225539468426265064","288850291653178849972385968723117812629","298822043767366335243141485385191596255","48499556637714824245597102797447253878","6208060487310465084273187815814510990"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/FdOutStream.h"},"id":"CVE-2019-15694-e8fef214","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["244898307285607222563950983609948346553","43341883940359034701178509634248810808","22408825226224875324426357928765543832","60530162050125679653946289113577625063","76107314312341759972938036182515678925","18495751838936931870568384318138527877","61931596568621288510154184647743829985","253823076434691330261062532092873277700","254225327870488393069051522463336618036","159301435689726407364870564697366360066","85589509358529502174652398297687461958","27733562361413048841963154418597428512","267145303541782909907947673219714351786","323141724127020486172182574447184703104"]},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/HexInStream.h"},"id":"CVE-2019-15694-ea2822e1","signature_version":"v1"},{"signature_version":"v1","deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","signature_type":"Line","target":{"file":"common/rdr/ZlibOutStream.cxx"},"id":"CVE-2019-15694-f7c1772a","digest":{"threshold":0.9,"line_hashes":["788418275041876144104071365232394748","55158404610862932387061218103938622375","216517420909707281243634226871702905505","251654775379643296845609202287505515505","242898085802677864879924569630847969573","276135911889755914078004098902569028802","151024028086634517976279733000052360909","82965866617931834765639636394134776902","54670713426665813214826927107117377423","76258152986686058292984201441017210397","252080884080013982449501210697398693142","35458292050147967809376086973913052176","152350664892770783519354561765572695886","116246027747354098453836863570974272666","74440812529400276484563510483358711542","327250220345204538334784903628094393972","112323667358162469976394223551032062881","228137293814496458159979232211716871075","330082145924503145553009562963831210222","232111282591450778276508934925926156997"]}},{"digest":{"function_hash":"87762286769633400919795729447345962908","length":525},"deprecated":false,"source":"https://github.com/cendioossman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438","target":{"function":"TLSInStream::overrun","file":"common/rdr/TLSInStream.cxx"},"signature_type":"Function","id":"CVE-2019-15694-fde2eeca","signature_version":"v1"}],"vanir_signatures_modified":"2026-04-11T14:11:01Z","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"15.1"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15694.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}