CVE-2011-1164: Vino External Network Connection Vulnerability

vino Updated 02 Oct 2025

Summary

12/03/2013

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2011-1164: Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier for remote attackers to perform attacks. Affects vino versions 3.22.0-6 – 3.22.0-7. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Vino is a package in the Debian ecosystem that provides a VNC (Virtual Network Computing) server for the GNOME desktop environment. It allows users to remotely access and control their GNOME desktop sessions. Vino is commonly used for remote administration or support purposes.

Vulnerability Detail

The vulnerability identified as CVE-2011-1164 in Vino versions prior to 2.99.4 allows the VNC server to connect to external networks, despite the statement in the vino-preferences dialog box indicating otherwise. This flaw may enable remote attackers to exploit the VNC server and potentially perform unauthorized actions or attacks.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a workaround, users can disable the Vino VNC server or restrict network access to the VNC port (usually 5900) using firewall rules. However, it is strongly advised to apply the official fix by upgrading to the patched version of Vino.

Conclusion

In conclusion, the CVE-2011-1164 vulnerability in Vino allows the VNC server to connect to external networks despite claims to the contrary. Upgrading to Vino version 2.99.4 or later is recommended to mitigate this vulnerability. Users can also apply workarounds such as disabling the VNC server or implementing firewall rules. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for vino →