USN-9088-1: TigerVNC vulnerability
It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. A remote attacker could possibly use this issue to impersonate any VNC server after a user had added a certificate exception for the attacker's server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/tigervnc-commonto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/tigervnc-scraping-serverto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/tigervnc-standalone-serverto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/tigervnc-viewerto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/tigervnc-xorg-extensionto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
Which Ubuntu packages should be reviewed for exposure?
Review installations of tigervnc-common, tigervnc-scraping-server, tigervnc-standalone-server, tigervnc-viewer, and tigervnc-xorg-extension.