Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-6474-1
HistoryNov 08, 2023 - 12:00 a.m.

xrdp vulnerabilities

2023-11-0800:00:00
ubuntu.com
46
xrdp
ubuntu
vulnerabilities
out-of-bounds
reads
writes
session establishment errors
cve
memory corruption
execute arbitrary code

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.002

Percentile

58.0%

JSON

Releases

  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 ESM
  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM

Packages

  • xrdp - Remote Desktop Protocol (RDP) server

Details

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,
CVE-2023-42822)

It was discovered that xrdp improperly handled session establishment
errors. An attacker could potentially use this issue to bypass the
OS-level session restrictions by PAM. (CVE-2023-40184)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-23478)

It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchxrdp< 0.9.17-2ubuntu2+esm1UNKNOWN
Ubuntu22.04noarchxrdp< 0.9.17-2ubuntu2UNKNOWN
Ubuntu22.04noarchxrdp-dbgsym< 0.9.17-2ubuntu2UNKNOWN
Ubuntu20.04noarchxrdp< 0.9.12-1ubuntu0.1+esm1UNKNOWN
Ubuntu20.04noarchxrdp< 0.9.12-1ubuntu0.1UNKNOWN
Ubuntu20.04noarchxrdp-dbgsym< 0.9.12-1ubuntu0.1UNKNOWN
Ubuntu18.04noarchxrdp< 0.9.5-2ubuntu0.1~esm2UNKNOWN
Ubuntu18.04noarchxorgxrdp< 0.9.5-2UNKNOWN
Ubuntu18.04noarchxorgxrdp-dbgsym< 0.9.5-2UNKNOWN
Ubuntu18.04noarchxrdp< 0.9.5-2UNKNOWN
Rows per page:
1-10 of 181

Related

nessus 25
openvas 26
osv 20
fedora 10
redos 2
mageia 3
rosalinux 3
debian 3
freebsd 4
altlinux 2
prion 13
nvd 13
veracode 12
debiancve 12
ubuntucve 13
alpinelinux 13
vulnrichment 1
cve 12
cvelist 12
nessus
nessus
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xrdp vulnerabilities (USN-6474-1)
2023-11-09 00:00:00
Debian DSA-5502-1 : xrdp - security update
2023-09-19 00:00:00
Fedora 36 : 1:xrdp (2022-08d2138578)
2022-12-23 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6474-1)
2023-11-10 00:00:00
Mageia: Security Advisory (MGASA-2023-0002)
2023-03-28 00:00:00
Debian: Security Advisory (DSA-5502-1)
2023-09-19 00:00:00
osv
osv
xrdp vulnerabilities
2023-11-08 13:47:00
libpainter0-0.9.20-4.1 on GA media
2024-06-15 00:00:00
xrdp - security update
2023-09-18 00:00:00
fedora
fedora
[SECURITY] Fedora 36 Update: xrdp-0.9.21-1.fc36
2022-12-21 01:18:14
[SECURITY] Fedora 37 Update: xrdp-0.9.21-1.fc37
2022-12-21 01:28:50
[SECURITY] Fedora 34 Update: xrdp-0.9.18-5.fc34
2022-02-17 03:06:42
redos
redos
ROS-20221222-01
2022-12-22 00:00:00
ROS-20231024-02
2023-10-24 00:00:00
mageia
mageia
Updated xrdp packages fix security vulnerability
2023-01-13 20:37:09
Updated xrdp packages fix security vulnerability
2023-12-01 14:54:47
Updated xrdp packages fix security vulnerability
2023-09-30 22:15:40
rosalinux
rosalinux
Advisory ROSA-SA-2023-2249
2023-10-21 13:15:43
Advisory ROSA-SA-2024-2445
2024-07-09 12:31:47
Advisory ROSA-SA-2023-2085
2023-02-02 08:13:45
debian
debian
[SECURITY] [DSA 5502-1] xrdp security update
2023-09-18 21:42:53
[SECURITY] [DLA 3370-1] xrdp security update
2023-03-30 11:35:46
[SECURITY] [DLA 3375-1] xrdp security update
2023-03-31 14:34:21
freebsd
freebsd
xrdp -- multiple vulnerabilities
2022-12-01 00:00:00
xrdp -- unchecked access to font glyph info
2023-09-27 00:00:00
xrdp -- privilege escalation
2022-01-23 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package xrdp version 0.9.21-alt1
2022-12-21 00:00:00
Security fix for the ALT Linux 10 package xrdp version 0.9.18.1-alt1
2022-02-11 00:00:00
prion
prion
Integer overflow
2022-02-07 22:15:00
Design/Logic Flaw
2022-12-09 18:15:00
Design/Logic Flaw
2022-12-09 18:15:00
nvd
nvd
CVE-2022-23613
2022-02-07 22:15:08
CVE-2023-40184
2023-08-30 18:15:09
CVE-2023-42822
2023-09-27 18:15:11
veracode
veracode
Improper Session Handling
2023-09-05 08:07:39
Information Disclosure
2023-10-02 20:01:55
Improper Handling Of Exceptional Conditions
2023-09-07 12:29:42
debiancve
debiancve
CVE-2023-42822
2023-09-27 18:15:11
CVE-2022-23483
2022-12-09 18:15:16
CVE-2022-23613
2022-02-07 22:15:08
ubuntucve
ubuntucve
CVE-2022-23483
2022-12-09 00:00:00
CVE-2022-23468
2022-12-09 00:00:00
CVE-2022-23479
2022-12-09 00:00:00
alpinelinux
alpinelinux
CVE-2022-23613
2022-02-07 22:15:08
CVE-2022-23483
2022-12-09 18:15:16
CVE-2022-23484
2022-12-09 18:15:17
vulnrichment
vulnrichment
CVE-2023-42822 Unchecked access to font glyph info in xrdp
2023-09-27 17:55:02
cve
cve
CVE-2023-40184
2023-08-30 18:15:09
CVE-2022-23478
2022-12-09 18:15:14
CVE-2022-23479
2022-12-09 18:15:14
cvelist
cvelist
CVE-2022-23483 Out-of-Bound Read in libxrdp
2022-12-09 17:50:52
CVE-2022-23478 Out of Bound Write in xrdp
2022-12-09 17:49:42
CVE-2022-23613 Privilege escalation on xrdp
2022-02-07 21:40:09

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.002

Percentile

58.0%

JSON
Related for USN-6474-1
nessus25openvas26osv20fedora10redos2mageia3rosalinux3debian3freebsd4altlinux2prion13nvd13veracode12debiancve12ubuntucve13alpinelinux13vulnrichment1cve12cvelist12