In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervnc-selinuxUpgrade tigervncUpgrade tigervnc-license | May 4, 2022 | Sep 27, 2020 |
| Centos_linux | — | Upgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-iconsUpgrade tigervncUpgrade tigervnc-serverUpgrade tigervnc-selinux | Jun 1, 2021 | Sep 27, 2020 |
| Debian | — | Upgrade tigervnc | Oct 8, 2020 | Sep 27, 2020 |
| Gentoo Linux | — | Upgrade net-misc/tigervnc. | Jul 9, 2024 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-minimal | Feb 22, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervncUpgrade tigervnc-license | Jan 20, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade tigervnc-server | Feb 3, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-licenseUpgrade tigervnc | Dec 15, 2020 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade tigervnc-help | Nov 3, 2020 | Sep 27, 2020 |
| Oracle Solaris | — | Upgrade x11/server/xvnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade desktop/remote-desktop/tigervnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 27, 2020 |
| Oracle_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-selinuxUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervncUpgrade tigervnc-license | May 26, 2021 | Sep 18, 2020 |
| Redhat_linux | — | No solution existsUpgrade tigervnc-debuginfoUpgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-server-debuginfoUpgrade tigervnc-selinuxUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-minimalUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-module | May 21, 2021 | Sep 27, 2020 |
| Rocky_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-server-debuginfoUpgrade tigervncUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module | Mar 12, 2024 | Sep 27, 2020 |
| Suse | — | Upgrade libXvnc-develUpgrade tigervnc-x11vncUpgrade xorg-x11-Xvnc-javaUpgrade libXvnc1Upgrade xorg-x11-Xvnc-novncUpgrade tigervncUpgrade xorg-x11-Xvnc-moduleUpgrade xorg-x11-Xvnc | Feb 7, 2021 | Sep 27, 2020 |
| Ubuntu | — | Upgrade tigervnc-standalone-server (Ubuntu Pro)Upgrade tigervnc-scraping-server (Ubuntu Pro)Upgrade tigervnc-common (Ubuntu Pro) | Mar 22, 2023 | Sep 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub