The novnc package provides a VNC client that uses HTML5 (Web Sockets, Canvas) and includes encryption support.
It was discovered that noVNC did not properly set the 'secure' flag when issuing cookies. An attacker could use this flaw to intercept cookies via a man-in-the-middle attack. (CVE-2013-7436)
All novnc users are advised to upgrade to this updated package, which corrects this issue.