[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1053284: marked as done (xrdp: CVE-2023-42822: Unchecked access to font glyph info)

Your message dated Thu, 04 Jan 2024 07:21:07 +0000
with message-id <E1rLI2N-00AKxF-8B@fasolo.debian.org>
and subject line Bug#1053284: fixed in xrdp 0.9.24-1
has caused the Debian Bug report #1053284,
regarding xrdp: CVE-2023-42822: Unchecked access to font glyph info
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1053284: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053284
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: xrdp
Version: 0.9.21.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for xrdp.

CVE-2023-42822[0]:
| xrdp is an open source remote desktop protocol server. Access to the
| font glyphs in xrdp_painter.c is not bounds-checked . Since some of
| this data is controllable by the user, this can result in an out-of-
| bounds read within the xrdp executable. The vulnerability allows an
| out-of-bounds read within a potentially privileged process. On non-
| Debian platforms, xrdp tends to run as root. Potentially an out-of-
| bounds write can follow the out-of-bounds read. There is no denial-
| of-service impact, providing xrdp is running in forking mode. This
| issue has been addressed in release 0.9.23.1. Users are advised to
| upgrade. There are no known workarounds for this vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-42822
    https://www.cve.org/CVERecord?id=CVE-2023-42822
[1] https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw
[2] https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: xrdp
Source-Version: 0.9.24-1
Done: Gürkan Myczko <tar@debian.org>

We believe that the bug you reported is fixed in the latest version of
xrdp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1053284@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Gürkan Myczko <tar@debian.org> (supplier of updated xrdp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 02 Jan 2024 23:13:41 +0100
Source: xrdp
Architecture: source
Version: 0.9.24-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org>
Changed-By: Gürkan Myczko <tar@debian.org>
Closes: 1036056 1051061 1053284
Changes:
 xrdp (0.9.24-1) experimental; urgency=medium
 .
   * New upstream version. (Closes: #1053284, #1051061)
     (CVE-2023-42822 and CVE-2023-40184)
   * d/clean: added.
   * d/control: replace lsb-base with sysvinit-utils,
     add myself to Uploaders.
   * Thanks for the better d/watch file patch. (Closes: #1036056)
   * Add myself to Uploaders.
   * d/README.Debian, add information about #907878.
Checksums-Sha1:
 114a4519010c50f774cb3c834472539dacd39c39 2254 xrdp_0.9.24-1.dsc
 3d6fd40f76384413a5d6eef441cb1be95d468663 2068985 xrdp_0.9.24.orig.tar.gz
 f3a818bacffe878c59c6767c7da222198e85a996 23184 xrdp_0.9.24-1.debian.tar.xz
 742edc2d24ac4b8f4df75e90275fbef3ea274177 8477 xrdp_0.9.24-1_source.buildinfo
Checksums-Sha256:
 491ffaf3a3ff9a138c8f9b1cf4e9f5ed0b01eafc3e9edba3fa5eab6d1ed17c49 2254 xrdp_0.9.24-1.dsc
 68b2c58254ed8488900b99e6f84ed666324e7665614ce68d21dcf2f5e8ad1717 2068985 xrdp_0.9.24.orig.tar.gz
 a3eac9b522b05c06ef641d7d6e9ab364df86f395ad15516f39b61467859a6fcd 23184 xrdp_0.9.24-1.debian.tar.xz
 76922843d32c9b9c41aadf214141ce6ae5edc9ac7b0e0b1dfebdb65779e8d091 8477 xrdp_0.9.24-1_source.buildinfo
Files:
 43f853dba504b0ec1e66eab120486e76 2254 net optional xrdp_0.9.24-1.dsc
 652e9dea23ee97b07e85a7636efd1733 2068985 net optional xrdp_0.9.24.orig.tar.gz
 c26a15a5bd7b142b4a3a41c2d097d83a 23184 net optional xrdp_0.9.24-1.debian.tar.xz
 5c83c6d07ce67c4ed94320df54a2b733 8477 net optional xrdp_0.9.24-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEtgob82PcExn/Co6JEWhSvN91FcAFAmWWWZwACgkQEWhSvN91
FcAsEw/+LA+Y2NIBw99i6c54IXrN/jmBYZhDxx1E7X21JnEWoF9rfqT3aUh+Nb7K
nGWN1+isUfIFQKvYA5HVylFN4z8+TTj7mLGG1AhQ3EcAT4kmoqNIRyN1ALr8V4rk
u5tVyJESpZDH1PGWOi3Oih2lv0VHIf3d/ATF1x+C87lt4Jz0ErSN/HFzC1fRLvrL
M2R1xxJe54wZTOLByid+Qzl9RUP4w+ScY4Hj2Jz2NvLt3ITLelQXcrqT2KHjJFD8
qw+DiCDNnPQGLJOKNOPkbLEF/9fY7fHtPpyzVV8Fs6rqZm42dcrdzUJfMfLq7JHv
CTVFxUxy6MMMfBu3zA8c4N9DphjMe3WBRTEVC9WRJKOZj4xD68jW/1MP0JLDdK9T
CVclIAd89oLUoXDYK1yBGpEMxOG4D5IRXyWCpcAkMpbY9Pi6QyU0EkdXOYiWLcoC
CZMYnROGYe+LMmNlXEgI5vse2ljUzzjKT4fyWGlxR09oiZ9nbOvJi9YzD/Ju19wm
8AxmX0XY88qB7UQpTBOTdlmcHsdPTe6BenzmmPxhLbs3rWCPueDjeHyWJQlTY1Gc
WTd+zDNF0JPkgJ5xsH1jW42NGsZbV9p+SLzw3KF1YrXWq3rY/BLBBMqQJS2lzc59
JMiEIXJGxKDSYIecCsb+OSqrd+9hHAsYzXlC7kKdQm/65okPCe4=
=Z2fa
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: