Lucene search

K
debianDebianDEBIAN:DLA-3370-1:E4F0D
HistoryMar 30, 2023 - 11:35 a.m.

[SECURITY] [DLA 3370-1] xrdp security update

2023-03-3011:35:46
lists.debian.org
8
xrdp
security update
debian 10

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

57.6%


Debian LTS Advisory DLA-3370-1 [email protected]
https://www.debian.org/lts/security/ Dominik George
March 28, 2023 https://wiki.debian.org/LTS

Package : xrdp
Version : 0.9.9-1+deb10u2
CVE ID : CVE-2022-23468 CVE-2022-23478 CVE-2022-23479 CVE-2022-23483
CVE-2022-23484 CVE-2022-23493
Debian Bug :

Several out of bounds memory access and buffer overflows were fixed in xrdp,
an open source project which provides a graphical login to remote machines
using Microsoft Remote Desktop Protocol (RDP)

CVE-2022-23468

xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
There are no known workarounds for this issue.

CVE-2022-23478

xrdp < v0.9.21 contain a Out of Bound Write in
xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known
workarounds for this issue.

CVE-2022-23479

xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
There are no known workarounds for this issue.

CVE-2022-23483

xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
There are no known workarounds for this issue.

CVE-2022-23484

xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text()
function. There are no known workarounds for this issue.

CVE-2022-23493

xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close()
function. There are no known workarounds for this issue.

For Debian 10 buster, these problems have been fixed in version
0.9.9-1+deb10u2.

We recommend that you upgrade your xrdp packages.

For the detailed security status of xrdp please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xrdp

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

57.6%