Release Notes$$$Significant changes relative to 3.1.3:$$$Fixed an issue whereby the TurboVNC Viewer threw a NullPointerException if a user clicked the Connect button in the New TurboVNC Connection dialog after entering an SSH username with a blank VNC host into the VNC server field.$$$$$$To better emulate the behavior of OpenSSH; the TurboVNC Viewers built-in SSH client now allows the value of the SSHPort parameter; if specified on the command line or in a connection info file; to override any SSH ports specified in the OpenSSH config file.$$$$$$The TurboVNC Server now includes various security fixes (CVE-2023-5367; CVE-2023-6377; CVE-2023-6478; CVE-2023-6816; CVE-2024-0229; CVE-2024-0408; CVE-2024-9632; CVE-2024-21885; CVE-2024-21886; CVE-2024-31080; CVE-2024-31081; and CVE-2024-31083) from the xorg-server 21.1.x code base.$$$$$$Worked around an issue whereby recent versions of GNOME failed to launch in a TurboVNC session if the initial resolution of any of the screens in the session matched one of the default X RandR modes.$$$$$$Fixed an issue in the Mac TurboVNC Viewer whereby the viewer window did not display a vertical scrollbar; and the horizontal scrollbar was incorrectly sized; if multi-screen spanning was enabled; the scaled remote desktop was larger than the viewer window; and Displays have separate Spaces was enabled in the system settings.$$$$$$The Windows TurboVNC Viewer now sends Alt-F4 keystrokes to the VNC server if keyboard grabbing is enabled.$$$$$$Fixed a regression introduced by 3.1.2[2] that caused the Mac and Windows TurboVNC Viewers to incorrectly interpret Shift + vertical scroll wheel events as horizontal scroll wheel events.$$$$$$Fixed an issue whereby the TurboVNC Viewers built-in SSH client threw a NullPointerException if a cipher algorithm supported by the SSH server but not by the SSH client was specified using the Ciphers OpenSSH config file keyword.$$$$$$Fixed an issue in the TurboVNC Viewers built-in SSH client whereby the SSH connection timeout specified using the ConnectTimeout OpenSSH config file keyword was interpreted as milliseconds rather than seconds. This caused the SSH connection to fail if the timeout was too low.$$$$$$Fixed a regression introduced by 3.1 beta1[3] whereby the value of the TurboVNC Viewers Subsampling parameter; if specified using the Samp alias; did not override per-host options that were previously saved by the TurboVNC Viewer Options dialog.

3.1.3 Latest$$$@dcommander dcommander released this last week$$$ 3.1.3$$$ 9ae92b0$$$Assets$$$turbovnc-3.1.3.tar.gz is the official source tarball for this release. The automatically generated Source code assets are not supported.$$$Refer to https://TurboVNC.org/Downloads/DigitalSignatures for information regarding the methods used to sign the files in this release and instructions for verifying the signatures.$$$The binary packages were built with libjpeg-turbo 3.0.4 and Adoptium OpenJDK 17.0.13+11.$$$Support$$$Code Quality: Stable$$$Current Support Category: Active$$$$$$Documentation$$$User’s Guide for TurboVNC 3.1.3$$$$$$Release Notes$$$Significant changes relative to 3.1.2:$$$Added a new Xvnc command-line option (-noserverkeymap) that can be used to disable the server-side key mapping feature introduced in 3.1 beta1[4].$$$$$$Added a new Xvnc command-line option (-syslog) that can be used to redirect all TurboVNC Server and X.org errors; warnings; and messages to the system log.$$$$$$Fixed a regression introduced by 2.2 beta1[7] that prevented the TurboVNC Server from being used as an inetd service.$$$$$$The Tight Encoding Without Zlib RFB extension; which was used unofficially by the Lossless Tight encoding method since TurboVNC v0.5; has been officially registered with IANA as an RFB pseudo-encoding. The TurboVNC Viewer now advertises support for the pseudo-encoding. (The next major release of the TurboVNC Server will forego using the extension unless the VNC viewer advertises support for it.)$$$$$$Fixed an issue in the TurboVNC Viewers built-in SSH client whereby the ssh-rsa and rsa-sha2-512 signature schemes could not be used unless they were specified as the first argument for the HostKeyAlgorithms OpenSSH config file keyword or the server did not support rsa-sha2-256.$$$$$$Fixed an error (ZlibInStream: inflate failed) that occurred in the TurboVNC Viewer when it attempted to receive a clipboard update from QEMUs VNC server.$$$$$$Fixed a denial-of-service (DoS) vulnerability in the TurboVNC Server; introduced by 3.0 beta1[20]; that triggered an infinite loop in the servers automatic WebSocket detection code if an ill-behaved client sent 3 or fewer bytes of data immediately after connecting. Certain versions of Apache Guacamole were known to trigger this issue sporadically.$$$$$$The TurboVNC Viewer now works around an issue that prevented keyboard grabbing from working when running the viewer in a GNOME/Wayland session.

Release Notes$$$Significant changes relative to 3.1.1:$$$The TurboVNC Server now assigns an ordinal ID to every VNC viewer when the viewer connects; and when possible; log entries related to a specific viewer are prefixed by the viewers ID. The TurboVNC Server now also logs the total number of simultaneously connected viewers.$$$$$$The TurboVNC Viewer now sends horizontal scroll wheel events to the VNC server. (These events can be generated with horizontal scroll gestures on a trackpad or; with certain mice; by side-clicking the scroll wheel.)$$$$$$By default; the TurboVNC Server now limits the amount of time that it will wait for a new pointer event from a connected viewer that is dragging the mouse (and thus has exclusive control over the pointer.) This prevents other viewers connected to the same session from being locked out of pointer control indefinitely if a viewers network connection drops while it is dragging the mouse. A new Xvnc command-line option (-pointerlocktimeout) can be used to specify the time limit.$$$$$$The RPM and DEB packages generated by the TurboVNC build/packaging system now include a polkit rules file that prevents various authentication dialogs (Authentication is required to create a color managed device; Authentication is required to access the PC/SC daemon; Authentication is required to refresh the system repositories) from popping up when using the GNOME window manager with the TurboVNC Server on Ubuntu 23.10 and later (if the polkitd-pkla package is not installed) and on RHEL 7 and Fedora 19 and later (if the polkit-pkla-compat package is not installed.)$$$$$$The default X startup script (xstartup.turbovnc) now throws an error; rather than trying to execute xinitrc or twm; if a window manager is specified and the session desktop file for the window manager cannot be found.$$$$$$Added a new parameter (ExtSSHCommand) to the TurboVNC Viewer that can be used to specify the external SSH client command. In Via/Tunnel SSH command-line templates; including the default ones; %S is now replaced with the value of this new parameter.$$$$$$Fixed a regression introduced by 3.0 beta1[24] that caused the TurboVNC Server to leak memory when the RFB flow control extensions were used.$$$$$$Fixed several issues in the TurboVNC Viewer that prevented IPv6 addresses from being used as VNC hostnames.

3.1.1 Latest$$$@dcommander dcommander released this 3 days ago$$$ 3.1.1$$$ 6bc62cf$$$Assets$$$turbovnc-3.1.1.tar.gz is the official source tarball for this release. The automatically generated Source code assets are not supported.$$$Refer to https://TurboVNC.org/Downloads/DigitalSignatures for information regarding the methods used to sign the files in this release and instructions for verifying the signatures.$$$The binary packages were built with libjpeg-turbo 3.0.2 and Adoptium OpenJDK 17.0.10+7.$$$Support$$$Code Quality: Stable$$$Current Support Category: Active$$$$$$Documentation$$$User’s Guide for TurboVNC 3.1.1$$$$$$Release Notes$$$Significant changes relative to 3.1:$$$By default; each instance of the Linux TurboVNC Server now listens on the abstract Unix domain socket; in addition to the pathname Unix domain socket (under /tmp/.X11-unix); associated with its X display number. This prevents recent versions of GDM; when configured with WaylandEnable=false; from attempting to use Display :1 for the local session if a TurboVNC session is already using Display :1. The previous behavior can be restored by passing -nolisten local to vncserver or adding -nolisten local to the $serverArgs variable in turbovncserver.conf.$$$$$$The vncserver script now checks whether the abstract Unix domain socket associated with an X display number is in use before assuming that the display number is available.$$$$$$Fixed an issue in the Windows TurboVNC Viewer whereby an F10 key press; followed by an F10 key release; caused the keyboard focus to be redirected to the system menu; and subsequent keystrokes were consumed by the system menu until F10; left Alt; or Esc was pressed to dismiss the menu.$$$$$$Fixed an issue whereby GTK applications (including the GNOME window manager) running in a TurboVNC session attempted to display to a local Wayland session if one was active.

3.1 Latest$$$The binary packages were built with libjpeg-turbo 3.0.1 and Adoptium OpenJDK 17.0.9+9 (Adoptium OpenJDK 17.0.9+9.1 used for Windows.)$$$Support$$$Code Quality: Stable$$$Current Support Category: Active$$$$$$Documentation$$$User’s Guide for TurboVNC 3.1$$$$$$Release Notes$$$Significant changes relative to 3.1 beta2:$$$Improved the TurboVNC Viewers handling of SSH usernames in the following ways:$$$$$$Fixed a regression introduced in 3.1 beta1[3] whereby the SSH username was ignored if it was specified in the Server parameter or if it was specified in the TurboVNC Viewer Options dialog without also specifying the gateway host.$$$Fixed an issue whereby the SSH username was not saved and restored if it was specified in the TurboVNC Viewer Options dialog without also specifying the gateway host.$$$Fixed an issue whereby the SSH username was ignored if it was specified in the Server or Via parameter in ~/.vnc/default.turbovnc.$$$Added a new parameter (SSHUser) that can optionally be used to specify the SSH username. This parameter is set automatically from an SSH username specified in the Server or Via parameter; or it can be set manually.$$$To better emulate the behavior of OpenSSH; the TurboVNC Viewers built-in SSH client now allows an SSH username specified on the command line or in a connection info file to override an SSH username specified in the OpenSSH config file.$$$The LocalUsernameLC parameter now affects the SSH username if the SSH username is unspecified.$$$The TurboVNC Server now includes various security fixes (CVE-2022-2319; CVE-2022-2320; CVE-2022-4283; CVE-2022-46340; CVE-2022-46341; CVE-2022-46342; CVE-2022-46343; CVE-2022-46344; CVE-2023-0494; and CVE-2023-1393) from the xorg-server 21.1.x code base.$$$$$$The TurboVNC Viewer no longer requires that the VNC server support the QEMU LED State or VMware LED State RFB extension in order to use the QEMU Extended Key Event RFB extension. This fixes various key mapping issues when using the TurboVNC Viewer with wayvnc. However; it should be noted that; if the QEMU Extended Key Event extension is used without one of the LED State extensions; the lock key state on the client will lose synchronization with the lock key state on the remote desktop if a lock key is pressed outside of the TurboVNC Viewer window.

3.0.3$$$Significant changes relative to 3.0.2:$$$Fixed an issue in the Windows TurboVNC Viewer whereby a left Alt key press; followed by a left Alt key release; caused the keyboard focus to be redirected to the system menu; and subsequent keystrokes were consumed by the system menu until left Alt or Esc was pressed to dismiss the menu.$$$$$$Fixed an issue whereby Rosetta was required in order to install the TurboVNC package for Macs with Apple silicon CPUs.$$$$$$Fixed a regression introduced by 2.2 beta1[7] that prevented the idle timeout feature in the TurboVNC Server from working properly.$$$$$$The Mac TurboVNC Viewer app now informs macOS that it supports HiDPI monitors. This improves the sharpness of the remote desktop and TurboVNC Viewer GUI when using a Retina display.$$$$$$Fixed a regression introduced by 3.0 beta1[24] that caused the TurboVNC Server to become unresponsive if the network connection dropped and a VNC viewer disconnected before the network connection was restored.$$$$$$The vncserver script no longer passes -rfbwait 120000 to Xvnc. Effectively; that hard-coded the TurboVNC Servers send/receive timeout to 120 seconds; which doesnt make sense for most modern systems and networks. (The default value if -rfbwait is not passed to Xvnc is 20 seconds; which makes more sense.) The previous behavior can be restored by adding -rfbwait 120000 to the $serverArgs variable in turbovncserver.conf.$$$$$$Fixed an issue in the TurboVNC Viewer that sometimes caused the Java process to crash when closing the viewer window; particularly if multiple connections were open.$$$$$$Fixed a regression introduced by 3.0.1[3] whereby the TurboVNC Viewers built-in SSH client tried the ssh-rsa; rsa-sha2-256; and rsa-sha2-512 signature schemes in sequence for every RSA private key stored in the SSH agent; even if the SSH server did not support one or more of those signature schemes. This caused the SSH client to prematurely exceed the SSH servers maximum number of authentication attempts.$$$$$$Fixed an issue in the TurboVNC Viewers built-in SSH client whereby SSH private keys specified using the SSHKey and SSHKeyFile parameters or the IdentityFile OpenSSH config file keyword were added to the SSH agents persistent keychain. The SSH client now maintains its own temporary keychain rather than modifying the agents keychain.$$$$$$To better emulate the behavior of OpenSSH; the TurboVNC Viewers built-in SSH client has been improved in the following ways:$$$$$$If the SSH agent already has a copy of an SSH private key that was specified using the SSHKey or SSHKeyFile parameter or the IdentityFile OpenSSH config file keyword; then the SSH client now promotes the agents copy of the key to the head of the SSH clients keychain rather than adding a duplicate key to the end of the keychain. If the SSH agent does not have a copy of the specified SSH private key; then the SSH client now adds the new key to the head of its keychain if a valid passphrase for the key was specified or to the end of its keychain if a valid passphrase for the key was not specified.$$$The TurboVNC Viewer now treats ~/.ssh/id_ecdsa as a default private key. Each of the default private keys ~/.ssh/id_rsa; ~/.ssh/id_dsa; and ~/.ssh/id_ecdsa; in that order; will be added to the SSH clients keychain using the rules described above if the file exists and the SSHKey and SSHKeyFile parameters are not specified.$$$+; ^; and - can now be used at the beginning of the PubkeyAcceptedAlgorithms OpenSSH config file keyword to specify a set of algorithms that should be appended to; prepended to; or removed from the default list.$$$Fixed a regression introduced by 2.2.1[5] that caused the PreferredAuthentications OpenSSH config file keyword to be ignored.

3.0.2$$$Significant changes relative to 3.0.1:$$$The Linux/Un*x TurboVNC Viewer now works around an issue whereby Java on Un*x platforms generates a key release event without a corresponding key press event for dead keys on international keyboards.$$$$$$The TurboVNC Viewer no longer pops up the F8 menu if a modifier key (Shift; Ctrl; Alt; etc.) is pressed along with the menu key.$$$$$$Hotkeys in the Windows TurboVNC Viewer can no longer be triggered using the RCtrl-LAlt-Shift modifier sequence; because Windows uses RCtrl-LAlt to represent AltGr on international keyboards.$$$$$$The vncserver script now searches /usr/local/share/fonts for X11 fonts; which fixes an issue whereby the TurboVNC X server had few available fonts when running on recent FreeBSD releases.$$$$$$The Windows TurboVNC Viewer no longer overrides Javas default choice of high DPI scaling algorithms (nearest-neighbor interpolation) when using integral display scaling factors such as 200%. The viewer now emulates the behavior of Windows; using bilinear interpolation with fractional display scaling factors (per 3.0[6]) and nearest-neighbor interpolation with integral display scaling factors. This improves the sharpness of text when using the Windows TurboVNC Viewer with integral display scaling factors. The turbovnc.scalingalg system property can be set to bicubic; bilinear; or nearestneighbor to override the TurboVNC Viewers default algorithm choice.$$$$$$The TurboVNC Server now handles multitouch events sent by the UltraVNC Viewer from touchscreen-equipped Windows clients.$$$$$$The Mac TurboVNC Viewer no longer uses Command-V as a hotkey to toggle view-only mode. Mac applications typically use Command-V for pasting from the clipboard. Even though Un*x applications do not typically respond to that key sequence; Mac users sometimes attempt to use Command-V with TurboVNC out of habit; which caused view-only mode to be activated accidentally because of 3.0 beta1[28]. CTRL-ALT-SHIFT-V can still be used to toggle view-only mode.$$$$$$The TurboVNC Viewer normally reserves CTRL-ALT-SHIFT-{arrow keys} as hotkeys to move the horizontal and vertical scrollbars. However; those key sequences are also used by Emacs and GNOME. Thus; the TurboVNC Viewer now sends those key sequences to the server if no scrollbars are visible or if keyboard grabbing is enabled.$$$$$$Source: README.md; updated 2022-11-29

Significant changes relative to 3.0:$$$Fixed an error (JRELoadError) that occurred when attempting to use the Mac TurboVNC Viewer app with a custom JRE based on OpenJDK 17.$$$$$$The TurboVNC Viewers built-in SSH client now supports the OpenSSH v1 private key format. This fixes an invalid privatekey error that occurred when attempting to use a private key generated by a recent version of OpenSSH with the TurboVNC Viewer without ssh-agent or Pageant.$$$$$$The TurboVNC Viewers built-in SSH client now supports the rsa-sha2-256 and rsa-sha2-512 signature schemes (RSA keys with; respectively; the SHA-256 and SHA-512 hash algorithms.) This improves security and compatibility with recent OpenSSH releases. (OpenSSH v8.8 no longer supports the ssh-rsa signature scheme by default; since ssh-rsa uses the now-defeated SHA-1 hash algorithm.) The built-in SSH client now also supports the PubkeyAcceptedAlgorithms keyword in OpenSSH config files; which can be used to disable specific signature schemes that both the client and server support.$$$$$$The TurboVNC Server and Viewer now truncate both incoming and outgoing clipboard updates to the number of bytes specified by the -maxclipboard Xvnc argument or the MaxClipboard TurboVNC Viewer parameter. Previously the server only truncated incoming clipboard updates; and the viewer truncated outgoing clipboard updates while ignoring incoming clipboard updates larger than 256 kB.$$$$$$Fixed an issue in the TurboVNC Viewer whereby specifying a key other than a function key (F1 through F12) using the MenuKey parameter caused F1 to be selected in the Menu key combo box in the TurboVNC Viewer Options dialog.$$$$$$Fixed an error (Security type not supported) that occurred when attempting to connect to a TurboVNC session using the TurboVNC Session Manager if the VNC security type was disabled in the TurboVNC Viewer (by way of the SecurityTypes; SendLocalUserName; or User parameter or a corresponding check box in the TurboVNC Viewer Options dialog) and the SessMgrAuto parameter was enabled.$$$$$$The TurboVNC Viewer now builds and runs on Macs with Apple silicon CPUs.