Log in Start free

Vulnerability · Published Sep 27, 2023 · Assigned by GitHub_M

CVE-2023-42822Unchecked access to font glyph info in xrdp

Medium 4.6

In plain English

A medium-severity out-of-bounds read in xrdp from neutrinolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xrdp0.9.23.1-r0ALPINE-CVE-2023-42822
Alpine:v3.21xrdp0.9.23.1-r0ALPINE-CVE-2023-42822
Alpine:v3.22xrdp0.9.23.1-r0ALPINE-CVE-2023-42822
Alpine:v3.23xrdp0.9.23.1-r0ALPINE-CVE-2023-42822
Alpine:v3.24xrdp0.9.23.1-r0ALPINE-CVE-2023-42822
Debian:12xrdp0.9.21.1-1+deb12u1DEBIAN-CVE-2023-42822
Debian:13xrdp0.9.24-2DEBIAN-CVE-2023-42822
Debian:14xrdp0.9.24-2DEBIAN-CVE-2023-42822
Ubuntu:25.10xrdp0.10.1-3.1+deb13u1build0.25.10.1USN-8476-1

Affected products (as reported)

VendorProductVersions
neutrinolabs xrdp < 0.9.23.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References