ultravnc-viewer

maintainer Muflone · 40 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows PE binary (vncviewer.exe) from uvnc.com via a Joomla download redirect URL rather than a direct, versioned release artifact. While uvnc.com is the official UltraVNC vendor site, the download URL uses a Joomla component redirect (/component/jdownloads/send/...) which is not a stable, content-addressed release URL — it could silently serve a different binary over time. The binary is then installed and executed via Wine on the user's system. The sha256sum does provide integrity verification, which mitigates the worst supply-chain risk, but the indirect/redirect URL means the checksum could become stale or mismatched without obvious indication. This is a real medium concern: an executed binary from an indirect/non-canonical URL, even if from the official vendor domain. Not high because there is no evidence of malice, the domain is the official vendor, and a checksum is present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("${pkgname}-${pkgver}.zip"::"https://uvnc.com/component/jdownloads/send/0-/452-ultravnc-${pkgver//./-}-bin-zip.html?Itemid=0"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows PE binary (vncviewer.exe) from uvnc.com via a Joomla download redirect URL rather than a direct, versioned release artifact. While uvnc.com is the official UltraVNC vendor site, the download URL uses a Joomla component redirect (/component/jdownloads/send/...) which is not a stable, content-addressed release URL — it could silently serve a different binary over time. The binary is then installed and executed via Wine on the user's system. The sha256sum does provide integrity verification, which mitigates the worst supply-chain risk, but the indirect/redirect URL means the checksum could become stale or mismatched without obvious indication. This is a real medium concern: an executed binary from an indirect/non-canonical URL, even if from the official vendor domain. Not high because there is no evidence of malice, the domain is the official vendor, and a checksum is present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Muflone http://www.muflone.com/contacts/english/
    
      2
    
      3pkgname=ultravnc-viewer
    
      4pkgver=1.4.31
    
      5pkgrel=1
    
      6pkgdesc="A powerful VNC Client with a lot of features, compatible with Windows' UltraVNC servers"
    
      7arch=('any')
    
      8url="http://www.uvnc.com"
    
      9license=('GPL')
    
      10depends=('wine' 'hicolor-icon-theme')
    
      11source=("${pkgname}-${pkgver}.zip"::"https://uvnc.com/component/jdownloads/send/0-/452-ultravnc-${pkgver//./-}-bin-zip.html?Itemid=0"
    
      12        "${pkgname}"
    
      13        "${pkgname}-16.png"
    
      14        "${pkgname}-24.png"
    
      15        "${pkgname}-32.png"
    
      16        "${pkgname}-48.png"
    
      17        "${pkgname}-256.png"
    
      18        "${pkgname}.desktop"
    
      19        "${pkgname}-listen.desktop")
    
      20sha256sums=('ae5598b8bce93535ec0d7eae30dbc324d1b29311953fc07c4aa0a5e42489e8d1'
    
      21            '1738d173c1cb89e46207c70fda6a36b7eeea9ba31b469a0cce10bbd9e8deb9b0'
    
      22            '5386feaf65fff389db4e4e30950f97d64803815b1e1a219d45bf41c2bde45e21'
    
      23            '098876231f8006bb89fc54986175ec6d938fae2c9e4a6dafe9b5c9d36f7fb3a2'
    
      24            '48025bb333be1ab9ebf875ced00d98b5701bbd81bad361d34712bc00b2e3c0df'
    
      25            '26b29f4a99cc40e3c119eae0f3ae9195d41f57cb2377f1add3e4c771f752aaa2'
    
      26            '1106710eab5b5603c15a1c216ad181e60110e8dc17f6442985e24f631b6f5f1b'
    
      27            'c2a3cb12b9fdbd06fc9faf9907a591d7988233dd5e0046ccba625f5f8b3b367d'
    
      28            '6eefe94d1dacc0ca414a1e2ff5cc0fb2c272d3743b39240247000e5d03e6d9f2')
    
      29
    
      30package() {
    
      31  # Install binary files
    
      32  install -m 644 -D "${srcdir}/x86/vncviewer.exe" "${pkgdir}/usr/lib/${pkgname}/vncviewer.exe"
    
      33  # Install startup script
    
      34  install -m 755 -D "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      35  # Install icons
    
      36  for _size in 16 24 32 48 256
    
      37  do
    
      38    install -m 644 -D ${pkgname}-${_size}.png "${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/${pkgname}.png"
    
      39  done
    
      40  # Install desktop files
    
      41  install -m 755 -d "${pkgdir}/usr/share/applications"
    
      42  install -m 755 -t "${pkgdir}/usr/share/applications" "${pkgname}.desktop" "${pkgname}-listen.desktop"
    
      43}
    
      44
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2