According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the TigerVNC's     Xvnc server. A remote unauthenticated attacker could     use this flaw to make Xvnc crash by terminating the TLS     handshake process early. (CVE-2016-10207)

  - A double free flaw was found in the way TigerVNC     handled ClientFence messages. A remote, authenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted ClientFence messages,     resulting in denial of service. (CVE-2017-7393)

  - A missing input sanitization flaw was found in the way     TigerVNC handled credentials. A remote unauthenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted usernames, resulting in     denial of service. (CVE-2017-7394)

  - An integer overflow flaw was found in the way TigerVNC     handled ClientCutText messages. A remote, authenticated     attacker could use this flaw to make Xvnc crash by     sending specially crafted ClientCutText messages,     resulting in denial of service. (CVE-2017-7395)

  - A buffer overflow flaw, leading to memory corruption,     was found in TigerVNC viewer. A remote malicious VNC     server could use this flaw to crash the client     vncviewer process resulting in denial of service.
    (CVE-2017-5581)

  - A memory leak flaw was found in the way TigerVNC     handled termination of VeNCrypt connections. A remote     unauthenticated attacker could repeatedly send     connection requests to the Xvnc server, causing it to     consume large amounts of memory resources over time,     and ultimately leading to a denial of service due to     memory exhaustion. (CVE-2017-7392)

  - A memory leak flaw was found in the way TigerVNC     handled client connections. A remote unauthenticated     attacker could repeatedly send connection requests to     the Xvnc server, causing it to consume large amounts of     memory resources over time, and ultimately leading to a     denial of service due to memory exhaustion.
    (CVE-2017-7396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-7392 CVE-2017-7393 CVE-2017-7394 CVE-2017-7395 CVE-2017-7396.

Add systemd unit file for Xvnc.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0499 advisory.

    This advisory aggregates security fixes for the tigervnc SRPM in CIQ LTS 9.2. It addresses 28 CVEs:
    CVE-2022-46341, CVE-2017-7396, CVE-2025-49180, CVE-2025-26601, CVE-2025-49175, and 23 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
103085	EulerOS 2.0 SP1 : tigervnc (EulerOS-SA-2017-1227)	Nessus	Huawei Local Security Checks	9/11/2017	11/24/2025	critical
103086	EulerOS 2.0 SP2 : tigervnc (EulerOS-SA-2017-1228)	Nessus	Huawei Local Security Checks	9/11/2017	11/24/2025	critical
101597	Fedora 26 : tigervnc (2017-2d0066d567)	Nessus	Fedora Local Security Checks	7/17/2017	12/10/2025	high
355251	Rocky Linux 9.2 [CIQ] Security Update: tigervnc / tigervnc-debuginfo / tigervnc-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0499)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	critical

Detections

Analytics

Plugins Search

critical

critical

high

critical