Lucene search

K
mageiaGentoo FoundationMGASA-2023-0334
HistoryDec 01, 2023 - 2:54 p.m.

Updated xrdp packages fix security vulnerability

2023-12-0114:54:47
Gentoo Foundation
advisories.mageia.org
21
xrdp
security vulnerability
packages
font glyphs
bounds-checked
out-of-bounds read
out-of-bounds write
privileged process

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

30.5%

The updated packages fix a security vulnerability Access to the font glyphs in xrdp_painter.c is not bounds-checked. Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. (CVE-2023-42822)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchxrdp< 0.9.23.1-1xrdp-0.9.23.1-1.mga9

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

30.5%