Skip to content
Sign in Sign up
JA EN FR
SecPulse
Unrated

Unchecked access to font glyph info in xrdp

CVE-2023-42822 First seen on SecPulse

Fix status by distribution

Fixed packages published by each distribution for this CVE

Original description The description as published by the source.

xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details