TigerVNC Vulnerability — Ubuntu Security Update (USN-9088-1)

USN-9088-1 updates Ubuntu 20.04, Ubuntu 22.04: It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. Apply the update via standard apt tooling.

High 2026-11-12

Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

The advisory's own severity data peaks at CVSS ; unpatched Ubuntu 20.04, Ubuntu 22.04 servers remain exposed until updated.

Ubuntu Security Notices
USN-9088-1

Publication date

12 November 2026

Overview

TigerVNC could be made to expose sensitive information over the network.

Releases

18.04 LTS

Packages

tigervnc – Virtual network computing server and client

Details

It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker’s server.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
18.04 LTS bionic	tigervnc-common – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
	tigervnc-scraping-server – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
	tigervnc-standalone-server – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
	tigervnc-viewer – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
	tigervnc-xorg-extension – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.