[SECURITY] [DLA 1203-2] xrdp regression update

Package : xrdp Version : 0.5.0-2+deb7u3 A regression was added by the patch introduced in version 0.5.0-2+deb7u2 to fix CVE-2017-16927: xrdp-sesman started to segfault in libscp. For Debian 7 "Wheezy", these problems have been fixed in version 0.5.0-2+deb7u3. We recommend that you upgrade your xr...

Debian DLA-1203-2 : xrdp regression update

A regression was added by the patch introduced in version 0.5.0-2+deb7u2 to fix CVE-2017-16927: xrdp-sesman started to segfault in libscp. For Debian 7 'Wheezy', these problems have been fixed in version 0.5.0-2+deb7u3. We recommend that you upgrade your xrdp packages. NOTE: Tenable Network...

Fedora Update for xrdp FEDORA-2017-b891f919c5

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for xrdp FEDORA-2017-f67f3ffb5d

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for xrdp FEDORA-2017-1fb805bfc2

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-16927

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

CVE-2017-16927

CVE-2017-16927 affects xrdp (sesman) where scp_v0s_accept in sesman/libscp/libscp_v0.c uses an untrusted integer as a write length, enabling local denial of service via buffer overflow. Public records (Fedora 26/27, SUSE, Mageia) show this was fixed by upstream in 0.9.4 (and later 0.9.5 in some b...