| Package | Affected versions | Patched versions |
|---|---|---|
| tigervnc | = 1.1 |
The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free