[SECURITY] [DLA 2396-1] tigervnc security update

2020-10-0621:41:55

lists.debian.org

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

72.3%

JSON

Debian LTS Advisory DLA-2396-1 [email protected]
https://www.debian.org/lts/security/ Roberto C. Sánchez
October 06, 2020 https://wiki.debian.org/LTS

Package : tigervnc
Version : 1.7.0+dfsg-7+deb9u2
CVE ID : CVE-2020-26117
Debian Bug : 971272

A vulnerability was discovered in tigernvc, a Virtual Network Computing
client and server implementation. The viewer implementation mishandles
TLS certificate exceptions, storing the certificates as authorities,
meaning that the owner of a certificate could impersonate any server
after a client had added an exception.

For Debian 9 stretch, this problem has been fixed in version
1.7.0+dfsg-7+deb9u2.

We recommend that you upgrade your tigervnc packages.

For the detailed security status of tigervnc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tigervnc

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9alltigervnc< 1.7.0+dfsg-7+deb9u2tigervnc_1.7.0+dfsg-7+deb9u2_all.deb
Debian10mipseltigervnc-scraping-server-dbgsym< 1.9.0+dfsg-3+deb10u3tigervnc-scraping-server-dbgsym_1.9.0+dfsg-3+deb10u3_mipsel.deb
Debian10armeltigervnc-viewer< 1.9.0+dfsg-3+deb10u3tigervnc-viewer_1.9.0+dfsg-3+deb10u3_armel.deb
Debian10amd64tigervnc-viewer-dbgsym< 1.9.0+dfsg-3+deb10u3tigervnc-viewer-dbgsym_1.9.0+dfsg-3+deb10u3_amd64.deb
Debian10ppc64eltigervnc-scraping-server< 1.9.0+dfsg-3+deb10u3tigervnc-scraping-server_1.9.0+dfsg-3+deb10u3_ppc64el.deb
Debian10i386tigervnc-common-dbgsym< 1.9.0+dfsg-3+deb10u3tigervnc-common-dbgsym_1.9.0+dfsg-3+deb10u3_i386.deb
Debian9armeltigervnc-viewer< 1.7.0+dfsg-7+deb9u2tigervnc-viewer_1.7.0+dfsg-7+deb9u2_armel.deb
Debian10amd64tigervnc-scraping-server< 1.9.0+dfsg-3+deb10u3tigervnc-scraping-server_1.9.0+dfsg-3+deb10u3_amd64.deb
Debian10s390xtigervnc-common-dbgsym< 1.9.0+dfsg-3+deb10u3tigervnc-common-dbgsym_1.9.0+dfsg-3+deb10u3_s390x.deb
Debian10mipseltigervnc-viewer< 1.9.0+dfsg-3+deb10u3tigervnc-viewer_1.9.0+dfsg-3+deb10u3_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	tigervnc	< 1.7.0+dfsg-7+deb9u2	tigervnc_1.7.0+dfsg-7+deb9u2_all.deb
Debian	10	mipsel	tigervnc-scraping-server-dbgsym	< 1.9.0+dfsg-3+deb10u3	tigervnc-scraping-server-dbgsym_1.9.0+dfsg-3+deb10u3_mipsel.deb
Debian	10	armel	tigervnc-viewer	< 1.9.0+dfsg-3+deb10u3	tigervnc-viewer_1.9.0+dfsg-3+deb10u3_armel.deb
Debian	10	amd64	tigervnc-viewer-dbgsym	< 1.9.0+dfsg-3+deb10u3	tigervnc-viewer-dbgsym_1.9.0+dfsg-3+deb10u3_amd64.deb
Debian	10	ppc64el	tigervnc-scraping-server	< 1.9.0+dfsg-3+deb10u3	tigervnc-scraping-server_1.9.0+dfsg-3+deb10u3_ppc64el.deb
Debian	10	i386	tigervnc-common-dbgsym	< 1.9.0+dfsg-3+deb10u3	tigervnc-common-dbgsym_1.9.0+dfsg-3+deb10u3_i386.deb
Debian	9	armel	tigervnc-viewer	< 1.7.0+dfsg-7+deb9u2	tigervnc-viewer_1.7.0+dfsg-7+deb9u2_armel.deb
Debian	10	amd64	tigervnc-scraping-server	< 1.9.0+dfsg-3+deb10u3	tigervnc-scraping-server_1.9.0+dfsg-3+deb10u3_amd64.deb
Debian	10	s390x	tigervnc-common-dbgsym	< 1.9.0+dfsg-3+deb10u3	tigervnc-common-dbgsym_1.9.0+dfsg-3+deb10u3_s390x.deb
Debian	10	mipsel	tigervnc-viewer	< 1.9.0+dfsg-3+deb10u3	tigervnc-viewer_1.9.0+dfsg-3+deb10u3_mipsel.deb