Security fix for CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396.

Add systemd unit file for Xvnc.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1611 advisory.

    This advisory aggregates security fixes for the tigervnc SRPM in CIQ LTS 8.6. It addresses 21 CVEs:
    CVE-2017-7396, CVE-2025-49180, CVE-2025-26601, CVE-2017-7394, CVE-2025-26595, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the TigerVNC's     Xvnc server. A remote unauthenticated attacker could     use this flaw to make Xvnc crash by terminating the TLS     handshake process early. (CVE-2016-10207)

  - A double free flaw was found in the way TigerVNC     handled ClientFence messages. A remote, authenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted ClientFence messages,     resulting in denial of service. (CVE-2017-7393)

  - A missing input sanitization flaw was found in the way     TigerVNC handled credentials. A remote unauthenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted usernames, resulting in     denial of service. (CVE-2017-7394)

  - An integer overflow flaw was found in the way TigerVNC     handled ClientCutText messages. A remote, authenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted ClientCutText messages,     resulting in denial of service. (CVE-2017-7395)

  - A buffer overflow flaw, leading to memory corruption,     was found in TigerVNC viewer. A remote malicious VNC     server could use this flaw to crash the client     vncviewer process resulting in denial of service.
    (CVE-2017-5581)

  - A memory leak flaw was found in the way TigerVNC     handled termination of VeNCrypt connections. A remote     unauthenticated attacker could repeatedly send     connection requests to the Xvnc server, causing it to     consume large amounts of memory resources over time,     and ultimately leading to a denial of service due to     memory exhaustion. (CVE-2017-7392)

  - A memory leak flaw was found in the way TigerVNC     handled client connections. A remote unauthenticated     attacker could repeatedly send connection requests to     the Xvnc server, causing it to consume large amounts of     memory resources over time, and ultimately leading to a     denial of service due to memory exhaustion.
    (CVE-2017-7396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99681	Fedora 24 : tigervnc (2017-a66ca10c22)	Nessus	Fedora Local Security Checks	2017/4/26	2025/12/23	high
364626	Rocky Linux 8.6 [CIQ] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ciqsa-2026_1611)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/12	critical
103085	EulerOS 2.0 SP1 : tigervnc (EulerOS-SA-2017-1227)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	critical
103086	EulerOS 2.0 SP2 : tigervnc (EulerOS-SA-2017-1228)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	critical

检测

插件搜索

high

critical

critical

critical