In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-tigervncalma-upgrade-tigervnc-iconsalma-upgrade-tigervnc-licensealma-upgrade-tigervnc-selinuxalma-upgrade-tigervnc-serveralma-upgrade-tigervnc-server-minimalalma-upgrade-tigervnc-server-module | May 4, 2022 | Sep 27, 2020 | |
| Centos_linux | — | centos-upgrade-tigervnccentos-upgrade-tigervnc-debuginfocentos-upgrade-tigervnc-debugsourcecentos-upgrade-tigervnc-iconscentos-upgrade-tigervnc-licensecentos-upgrade-tigervnc-selinuxcentos-upgrade-tigervnc-servercentos-upgrade-tigervnc-server-debuginfocentos-upgrade-tigervnc-server-minimalcentos-upgrade-tigervnc-server-minimal-debuginfocentos-upgrade-tigervnc-server-modulecentos-upgrade-tigervnc-server-module-debuginfo | Jun 1, 2021 | Sep 27, 2020 |
| Debian | debian-upgrade-tigervnc | Oct 8, 2020 | Sep 27, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-tigervnc | Jul 9, 2024 | Sep 27, 2020 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-tigervnchuawei-euleros-2_0_sp2-upgrade-tigervnc-iconshuawei-euleros-2_0_sp2-upgrade-tigervnc-licensehuawei-euleros-2_0_sp2-upgrade-tigervnc-serverhuawei-euleros-2_0_sp2-upgrade-tigervnc-server-minimal | Feb 22, 2021 | Sep 27, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-tigervnchuawei-euleros-2_0_sp3-upgrade-tigervnc-iconshuawei-euleros-2_0_sp3-upgrade-tigervnc-licensehuawei-euleros-2_0_sp3-upgrade-tigervnc-serverhuawei-euleros-2_0_sp3-upgrade-tigervnc-server-minimal | Jan 20, 2021 | Sep 27, 2020 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-tigervnchuawei-euleros-2_0_sp5-upgrade-tigervnc-iconshuawei-euleros-2_0_sp5-upgrade-tigervnc-licensehuawei-euleros-2_0_sp5-upgrade-tigervnc-serverhuawei-euleros-2_0_sp5-upgrade-tigervnc-server-minimal | Feb 3, 2021 | Sep 27, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tigervnchuawei-euleros-2_0_sp8-upgrade-tigervnc-iconshuawei-euleros-2_0_sp8-upgrade-tigervnc-licensehuawei-euleros-2_0_sp8-upgrade-tigervnc-serverhuawei-euleros-2_0_sp8-upgrade-tigervnc-server-minimal | Dec 15, 2020 | Sep 27, 2020 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-tigervnc-help | Nov 3, 2020 | Sep 27, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-desktop-remote-desktop-tigervnc-1-10-1-11-4-30-0-1-88-0oracle-solaris-11-4-upgrade-x11-server-xvnc-1-10-1-11-4-30-0-1-88-0 | Feb 17, 2021 | Sep 27, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-tigervncoracle-linux-upgrade-tigervnc-iconsoracle-linux-upgrade-tigervnc-licenseoracle-linux-upgrade-tigervnc-selinuxoracle-linux-upgrade-tigervnc-serveroracle-linux-upgrade-tigervnc-server-minimaloracle-linux-upgrade-tigervnc-server-module | May 26, 2021 | Sep 18, 2020 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-tigervncredhat-upgrade-tigervnc-debuginforedhat-upgrade-tigervnc-debugsourceredhat-upgrade-tigervnc-iconsredhat-upgrade-tigervnc-licenseredhat-upgrade-tigervnc-selinuxredhat-upgrade-tigervnc-serverredhat-upgrade-tigervnc-server-debuginforedhat-upgrade-tigervnc-server-minimalredhat-upgrade-tigervnc-server-minimal-debuginforedhat-upgrade-tigervnc-server-moduleredhat-upgrade-tigervnc-server-module-debuginfo | May 21, 2021 | Sep 27, 2020 | |
| Rocky_linux | rocky-upgrade-tigervncrocky-upgrade-tigervnc-debuginforocky-upgrade-tigervnc-debugsourcerocky-upgrade-tigervnc-serverrocky-upgrade-tigervnc-server-debuginforocky-upgrade-tigervnc-server-minimalrocky-upgrade-tigervnc-server-minimal-debuginforocky-upgrade-tigervnc-server-modulerocky-upgrade-tigervnc-server-module-debuginfo | Mar 12, 2024 | Sep 27, 2020 | |
| Suse | — | suse-upgrade-libxvnc-develsuse-upgrade-libxvnc1suse-upgrade-tigervncsuse-upgrade-tigervnc-x11vncsuse-upgrade-xorg-x11-xvncsuse-upgrade-xorg-x11-xvnc-javasuse-upgrade-xorg-x11-xvnc-modulesuse-upgrade-xorg-x11-xvnc-novnc | Feb 7, 2021 | Sep 27, 2020 |
| Ubuntu | ubuntu-pro-upgrade-tigervnc-commonubuntu-pro-upgrade-tigervnc-scraping-serverubuntu-pro-upgrade-tigervnc-standalone-server | Mar 22, 2023 | Sep 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub