Improper input validation in Tigervnc

CVE-2011-1775

The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.013 (67.3th percentile) — read the EPSS interpretation.

Affected products

  • Tigervnc — versions 1.1
  • N/a — versions n/a

Weakness classification (CWE)

References