In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade tigervnc-selinuxUpgrade tigervncUpgrade tigervnc-license | May 4, 2022 | Sep 27, 2020 |
| Centos_linux | — | Upgrade tigervnc-iconsUpgrade tigervnc-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-server-minimalUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade tigervnc-selinuxUpgrade tigervnc | Jun 1, 2021 | Sep 27, 2020 |
| Debian | — | Upgrade tigervnc | Oct 8, 2020 | Sep 27, 2020 |
| Gentoo Linux | — | Upgrade net-misc/tigervnc. | Jul 9, 2024 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-icons | Feb 22, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-icons | Jan 20, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervncUpgrade tigervnc-license | Feb 3, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-minimal | Dec 15, 2020 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade tigervnc-help | Nov 3, 2020 | Sep 27, 2020 |
| Oracle Solaris | — | Upgrade desktop/remote-desktop/tigervnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade x11/server/xvnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 27, 2020 |
| Oracle_linux | — | Upgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-server-moduleUpgrade tigervnc-selinuxUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-icons | May 26, 2021 | Sep 18, 2020 |
| Redhat_linux | — | Upgrade tigervnc-debugsourceUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-server-debuginfoNo solution existsUpgrade tigervnc-selinuxUpgrade tigervncUpgrade tigervnc-debuginfo | May 21, 2021 | Sep 27, 2020 |
| Rocky_linux | — | Upgrade tigervncUpgrade tigervnc-server-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module-debuginfo | Mar 12, 2024 | Sep 27, 2020 |
| Suse | — | Upgrade libXvnc1Upgrade tigervncUpgrade libXvnc-develUpgrade xorg-x11-Xvnc-novncUpgrade tigervnc-x11vncUpgrade xorg-x11-Xvnc-javaUpgrade xorg-x11-Xvnc-moduleUpgrade xorg-x11-Xvnc | Feb 7, 2021 | Sep 27, 2020 |
| Ubuntu | — | Upgrade tigervnc-common (Ubuntu Pro)Upgrade tigervnc-standalone-server (Ubuntu Pro)Upgrade tigervnc-scraping-server (Ubuntu Pro) | Mar 22, 2023 | Sep 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub