diff --git a/U_include-vencrypt-only-if-any-subtype-present.patch b/U_include-vencrypt-only-if-any-subtype-present.patch
new file mode 100644
index 0000000..406f316
--- /dev/null
+++ b/U_include-vencrypt-only-if-any-subtype-present.patch
@@ -0,0 +1,22 @@
+Index: common/rfb/Security.cxx
+===================================================================
+--- common/rfb/Security.cxx	(revision 5186)
++++ common/rfb/Security.cxx	(working copy)
+@@ -71,10 +71,15 @@
+   list<rdr::U8> result;
+   list<U32>::iterator i;
+ 
+-  result.push_back(secTypeVeNCrypt);
++  bool VeNCryptPresent = false;
+   for (i = enabledSecTypes.begin(); i != enabledSecTypes.end(); i++)
+-    if (*i < 0x100)
++    if (*i < 0x100) {
+       result.push_back(*i);
++    } else {
++      if(!VeNCryptPresent)
++        result.push_back(secTypeVeNCrypt);
++      VeNCryptPresent = true;
++    }
+ 
+   return result;
+ }
diff --git a/tigervnc.changes b/tigervnc.changes
index 18a0d3d..af11f88 100644
--- a/tigervnc.changes
+++ b/tigervnc.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Mon Aug  4 10:37:08 UTC 2014 - msrb@suse.com
+
+- U_include-vencrypt-only-if-any-subtype-present.patch
+  * Do not automatically offer VeNCrypt security if none of it's
+    subtypes is selected. (bnc#889781)
+
 -------------------------------------------------------------------
 Wed Jun  4 11:39:54 UTC 2014 - msrb@suse.com
 
diff --git a/tigervnc.spec b/tigervnc.spec
index 89ebb13..050887a 100644
--- a/tigervnc.spec
+++ b/tigervnc.spec
@@ -108,6 +108,7 @@ Patch5:         tigervnc-sf3495623.patch
 Patch6:         u_tigervnc-dont-send-ascii-control-characters.patch
 Patch7:         u_tigervnc-ignore-epipe-on-write.patch
 Patch8:         n_tigervnc-date-time.patch
+Patch9:         U_include-vencrypt-only-if-any-subtype-present.patch
 # Xserver patches
 Patch10:        tigervnc-1.2.80-fix-int-to-pointer.patch
 Patch11:        u_aarch64-support.patch
@@ -148,6 +149,7 @@ fi
 %patch6 -p0
 %patch7 -p0
 %patch8 -p1
+%patch9 -p0
 pushd unix/xserver
 patch -p1 < ../xserver114.patch
 %patch10 -p1