3.1.3

Assets

• turbovnc-3.1.3.tar.gz is the official source tarball for this release. The automatically generated "Source code" assets are not supported.
• Refer to https://TurboVNC.org/Downloads/DigitalSignatures for information regarding the methods used to sign the files in this release and instructions for verifying the signatures.
• The binary packages were built with libjpeg-turbo 3.0.4 and Adoptium OpenJDK 17.0.13+11.

Support

Code Quality: Stable
Current Support Category: Active

Documentation

User’s Guide for TurboVNC 3.1.3

Release Notes

Significant changes relative to 3.1.2:

1. Added a new Xvnc command-line option (-noserverkeymap) that can be used to disable the server-side key mapping feature introduced in 3.1 beta1[4].

2. Added a new Xvnc command-line option (-syslog) that can be used to redirect all TurboVNC Server and X.org errors, warnings, and messages to the system log.

3. Fixed a regression introduced by 2.2 beta1[7] that prevented the TurboVNC Server from being used as an inetd service.

4. The "Tight Encoding Without Zlib" RFB extension, which was used unofficially by the Lossless Tight encoding method since TurboVNC v0.5, has been officially registered with IANA as an RFB pseudo-encoding. The TurboVNC Viewer now advertises support for the pseudo-encoding. (The next major release of the TurboVNC Server will forego using the extension unless the VNC viewer advertises support for it.)

5. Fixed an issue in the TurboVNC Viewer's built-in SSH client whereby the ssh-rsa and rsa-sha2-512 signature schemes could not be used unless they were specified as the first argument for the HostKeyAlgorithms OpenSSH config file keyword or the server did not support rsa-sha2-256.

6. Fixed an error ("ZlibInStream: inflate failed") that occurred in the TurboVNC Viewer when it attempted to receive a clipboard update from QEMU's VNC server.

7. Fixed a denial-of-service (DoS) vulnerability in the TurboVNC Server, introduced by 3.0 beta1[20], that triggered an infinite loop in the server's automatic WebSocket detection code if an ill-behaved client sent 3 or fewer bytes of data immediately after connecting. Certain versions of Apache Guacamole were known to trigger this issue sporadically.

8. The TurboVNC Viewer now works around an issue that prevented keyboard grabbing from working when running the viewer in a GNOME/Wayland session.