Description
The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tigervnc +3 | 1.0.90-0.15.20110314svn4359.el6_1.1 | RHSA-2011:0871 |
Advisories 1
- RHSA-2011:0871 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- [oss-security] 20110506 CVE request: tigervnc mailing-list
- [oss-security] 20110509 Re: CVE request: tigervnc mailing-list
- [tigervnc-devel] 20110504 potential vulnerability in TLS secType? mailing-list
- [tigervnc-devel] 20110504 Re: potential vulnerability in TLS secType? mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=702672
- FEDORA-2011-6838 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=702470
- RHSA-2011:0871 vendor-advisory
- 44939 third-party-advisory
- 47738 vdb-entry
- [tigervnc-devel] 20110505 Re: potential vulnerability in TLS secType? mailing-list