CVE-2011-1775
Fixed in a distro release EPSS 1%
The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.
Products: tigervnc
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 | tigervnc | 0:1.0.90-0.15.20110314svn4359.el6_1.1 |
| Red Hat Enterprise Linux 6 | tigervnc-debuginfo | 0:1.0.90-0.15.20110314svn4359.el6_1.1 |
| Red Hat Enterprise Linux 6 | tigervnc-server | 0:1.0.90-0.15.20110314svn4359.el6_1.1 |
| Red Hat Enterprise Linux 6 | tigervnc-server-applet | 0:1.0.90-0.15.20110314svn4359.el6_1.1 |
| Red Hat Enterprise Linux 6 | tigervnc-server-module | 0:1.0.90-0.15.20110314svn4359.el6_1.1 |