Bug 78828

Created attachment 86985 [details]
TightVNC 1.2.6 patch

ref: http://marc.theaimsgroup.com/?l=vnc-list&m=103073945409801&w=2
ref: http://www.securityfocus.com/bid/5296 
cve: no-match

This is now CAN-2002-1336

TightVNC 1.2.7 is out now

1.2.7 changes:

- Unix and Win32 versions, Java viewer: The most significant problem
    with local cursor handling has been solved -- now clients can see
    remote cursor movements performed on the server or by another
    client. New PointerPos encoding and cursor shape updates both
    minimize bandwidth requirements and greatly improve responsiveness
    of the mouse pointer, while still allow to track correct pointer
    position in all situations.

  - Unix and Win32 versions: In all the places where display numbers
    had to be used, now it's easy to use port numbers as well. The
    viewers now allow to use new "hostname::port" syntax, in addition
    to the traditional "hostname:display" format. The same new syntax
    can be used in the "Add new client" dialog of Win32 server. In the
    server, now it's equally easy to set display and port numbers. 
    Besides that, HTTP and RFB port numbers can be set individually.

  - Unix and Win32 versions: In servers, decreased JPEG quality
    factors for low quality levels. This improves bandwidth usage
    while the image quality remains satisfactory in most cases. In
    clients, JPEG compression is now enabled by default, because
    usually it's a reasonable choice. To prevent viewers from
    requesting JPEG compression, new -nojpeg option can be used.

  - Unix version: Bugfix for Xvnc's -localhost and -interface options
    that were broken on many systems, thanks to Luke Mewburn for the
    bugfix. Xvnc -version command-line option is now supported.

  - Tight encoding is now documented in rfbproto.h files within source
    archives.

  - Java viewer: Implemented new buttons "Login again" and "Close
    window" near the disconnect or error messages in the applet mode,
    and introduced new "Offer Relogin" parameter to control this
    improvement. Thanks to Peter Astrand for the initial version of
    the "Login again" patch.

  - Java viewer: Support for connections via HTTP proxies using HTTP
    CONNECT method. This will not work in the applet mode, due to Java
    security restrictions.

  - Java viewer: Extra .vnc files have been removed, having just
    index.vnc should be enough. Also, an example HTML page has been
    prepared, to simplify installation under a standalone Web server.

  - Java viewer: Added a MANIFEST to the JAR archive, to allow easy
    execution of the JAR file, using java -jar command-line option.

  - Other minor improvements and bugfixes.

Or consider upgrading to (real)vnc-3.3.6.  (-: 
http://www.realvnc.org/.  

An errata has been issued which should help the problem described in this bug report. 
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen 
this bug report if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2002-287.html

reopening since the erratum was for Advanced Server.  The Red Hat Linux variant
is on its way soon.

An errata has been issued which should help the problem described in this bug report. 
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen 
this bug report if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2003-041.html