In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-selinux | May 4, 2022 | Sep 27, 2020 |
| Centos_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-debugsourceUpgrade tigervncUpgrade tigervnc-selinuxUpgrade tigervnc-server | Jun 1, 2021 | Sep 27, 2020 |
| Debian | — | Upgrade tigervnc | Oct 8, 2020 | Sep 27, 2020 |
| Gentoo Linux | — | Upgrade net-misc/tigervnc. | Jul 9, 2024 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-licenseUpgrade tigervnc | Feb 22, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervnc-licenseUpgrade tigervnc | Jan 20, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-licenseUpgrade tigervnc | Feb 3, 2021 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervnc-server | Dec 15, 2020 | Sep 27, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade tigervnc-help | Nov 3, 2020 | Sep 27, 2020 |
| Oracle Solaris | — | Upgrade x11/server/xvnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade desktop/remote-desktop/tigervnc to version 1.10.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 27, 2020 |
| Oracle_linux | — | Upgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade tigervnc-selinuxUpgrade tigervnc-icons | May 26, 2021 | Sep 18, 2020 |
| Redhat_linux | — | Upgrade tigervnc-server-debuginfoNo solution existsUpgrade tigervnc-debuginfoUpgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-selinuxUpgrade tigervnc-server-moduleUpgrade tigervnc-debugsourceUpgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-minimal | May 21, 2021 | Sep 27, 2020 |
| Rocky_linux | — | Upgrade tigervncUpgrade tigervnc-serverUpgrade tigervnc-debuginfoUpgrade tigervnc-server-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module | Mar 12, 2024 | Sep 27, 2020 |
| Suse | — | Upgrade xorg-x11-Xvnc-javaUpgrade libXvnc-develUpgrade libXvnc1Upgrade tigervnc-x11vncUpgrade tigervncUpgrade xorg-x11-Xvnc-novncUpgrade xorg-x11-Xvnc-moduleUpgrade xorg-x11-Xvnc | Feb 7, 2021 | Sep 27, 2020 |
| Ubuntu | — | Upgrade tigervnc-common (Ubuntu Pro)Upgrade tigervnc-scraping-server (Ubuntu Pro)Upgrade tigervnc-standalone-server (Ubuntu Pro) | Mar 22, 2023 | Sep 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub