Source: xrdp Version: 0.9.19-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerabilities were published for xrdp. CVE-2022-23468[0]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() | function. There are no known workarounds for this issue. Users are | advised to upgrade. CVE-2022-23477[1]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a buffer over flow in audin_send_open() function. | There are no known workarounds for this issue. Users are advised to | upgrade. CVE-2022-23478[2]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Out of Bound Write in | xrdp_mm_trans_process_drdynvc_channel_open() function. There are no | known workarounds for this issue. Users are advised to upgrade. CVE-2022-23479[3]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() | function. There are no known workarounds for this issue. Users are | advised to upgrade. CVE-2022-23480[4]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a buffer over flow in | devredir_proc_client_devlist_announce_req() function. There are no | known workarounds for this issue. Users are advised to upgrade. CVE-2022-23481[5]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Out of Bound Read in | xrdp_caps_process_confirm_active() function. There are no known | workarounds for this issue. Users are advised to upgrade. CVE-2022-23482[6]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Out of Bound Read in | xrdp_sec_process_mcs_data_CS_CORE() function. There are no known | workarounds for this issue. Users are advised to upgrade. CVE-2022-23483[7]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() | function. There are no known workarounds for this issue. Users are | advised to upgrade. CVE-2022-23484[8]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Integer Overflow in | xrdp_mm_process_rail_update_window_text() function. There are no known | workarounds for this issue. Users are advised to upgrade. CVE-2022-23493[9]: | xrdp is an open source project which provides a graphical login to | remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp | < v0.9.21 contain a Out of Bound Read in | xrdp_mm_trans_process_drdynvc_channel_close() function. There are no | known workarounds for this issue. Users are advised to upgrade. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2022-23468 https://www.cve.org/CVERecord?id=CVE-2022-23468 [1] https://security-tracker.debian.org/tracker/CVE-2022-23477 https://www.cve.org/CVERecord?id=CVE-2022-23477 [2] https://security-tracker.debian.org/tracker/CVE-2022-23478 https://www.cve.org/CVERecord?id=CVE-2022-23478 [3] https://security-tracker.debian.org/tracker/CVE-2022-23479 https://www.cve.org/CVERecord?id=CVE-2022-23479 [4] https://security-tracker.debian.org/tracker/CVE-2022-23480 https://www.cve.org/CVERecord?id=CVE-2022-23480 [5] https://security-tracker.debian.org/tracker/CVE-2022-23481 https://www.cve.org/CVERecord?id=CVE-2022-23481 [6] https://security-tracker.debian.org/tracker/CVE-2022-23482 https://www.cve.org/CVERecord?id=CVE-2022-23482 [7] https://security-tracker.debian.org/tracker/CVE-2022-23483 https://www.cve.org/CVERecord?id=CVE-2022-23483 [8] https://security-tracker.debian.org/tracker/CVE-2022-23484 https://www.cve.org/CVERecord?id=CVE-2022-23484 [9] https://security-tracker.debian.org/tracker/CVE-2022-23493 https://www.cve.org/CVERecord?id=CVE-2022-23493 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
