Security update for rdesktop (important)

An update that fixes 19 vulnerabilities is now available.

Description:

This update for rdesktop fixes the following issues:

rdesktop was updated to 1.8.6:

• Fix protocol code handling new licenses

rdesktop was updated to 1.8.5:

• Add bounds checking to protocol handling in order to fix many security
  problems when communicating with a malicious server.

rdesktop was updated to 1.8.4 (fix for boo#1121448):

• Add rdp_protocol_error function that is used in several fixes
• Refactor of process_bitmap_updates
• Fix possible integer overflow in s_check_rem() on 32bit arch
• Fix memory corruption in process_bitmap_data - CVE-2018-8794
• Fix remote code execution in process_bitmap_data - CVE-2018-8795
• Fix remote code execution in process_plane - CVE-2018-8797
• Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
• Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
• Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
• Fix Denial of Service in sec_recv - CVE-2018-20176
• Fix minor information leak in rdpdr_process - CVE-2018-8791
• Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
• Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
• Fix Denial of Service in process_bitmap_data - CVE-2018-8796
• Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
• Fix Denial of Service in process_secondary_order - CVE-2018-8799
• Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
• Fix major information leak in ui_clip_handle_data - CVE-2018-20174
• Fix memory corruption in rdp_in_unistr - CVE-2018-20177
• Fix Denial of Service in process_demand_active - CVE-2018-20178
• Fix remote code execution in lspci_process - CVE-2018-20179
• Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
• Fix remote code execution in seamless_process - CVE-2018-20181
• Fix remote code execution in seamless_process_line - CVE-2018-20182
• Fix building against OpenSSL 1.1

• remove obsolete patches

• rdesktop-Fix-OpenSSL-1.1-compability-issues.patch
• rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch

• update changes file

• add missing info about bugzilla 1121448

• Added rdesktop-Fix-decryption.patch Patch from
  https://github.com/rdesktop/rdesktop/pull/334 to fix connections to
  VirtualBox.

• update to 1.8.6

• Fix protocol code handling new licenses

• update to 1.8.5

• Add bounds checking to protocol handling in order to fix many security
  problems when communicating with a malicious server.

• Trim redundant wording from description.

• Use %make_install.

• update to 1.8.4 (fix for boo#1121448)

• Add rdp_protocol_error function that is used in several fixes
• Refactor of process_bitmap_updates
• Fix possible integer overflow in s_check_rem() on 32bit arch
• Fix memory corruption in process_bitmap_data - CVE-2018-8794
• Fix remote code execution in process_bitmap_data - CVE-2018-8795
• Fix remote code execution in process_plane - CVE-2018-8797
• Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
• Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
• Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
• Fix Denial of Service in sec_recv - CVE-2018-20176
• Fix minor information leak in rdpdr_process - CVE-2018-8791
• Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
• Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
• Fix Denial of Service in process_bitmap_data - CVE-2018-8796
• Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
• Fix Denial of Service in process_secondary_order - CVE-2018-8799
• Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
• Fix major information leak in ui_clip_handle_data - CVE-2018-20174
• Fix memory corruption in rdp_in_unistr - CVE-2018-20177
• Fix Denial of Service in process_demand_active - CVE-2018-20178
• Fix remote code execution in lspci_process - CVE-2018-20179
• Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
• Fix remote code execution in seamless_process - CVE-2018-20181
• Fix remote code execution in seamless_process_line - CVE-2018-20182
• Fix building against OpenSSL 1.1

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.1:

  zypper in -t patch openSUSE-2019-2135=1

• openSUSE Backports SLE-15-SP1:

  zypper in -t patch openSUSE-2019-2135=1