Bug#1025879: marked as done (xrdp: CVE-2022-23468 CVE-2022-23477 CVE-2022-23478 CVE-2022-23479 CVE-2022-23480 CVE-2022-23481 CVE-2022-23482 CVE-2022-23483 CVE-2022-23484 CVE-2022-23493)
Your message dated Tue, 20 Dec 2022 10:55:01 +0000
with message-id <E1p7aGz-003Iow-Dy@fasolo.debian.org>
and subject line Bug#1025879: fixed in xrdp 0.9.21.1-1
has caused the Debian Bug report #1025879,
regarding xrdp: CVE-2022-23468 CVE-2022-23477 CVE-2022-23478 CVE-2022-23479 CVE-2022-23480 CVE-2022-23481 CVE-2022-23482 CVE-2022-23483 CVE-2022-23484 CVE-2022-23493
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
1025879: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025879
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Source: xrdp
Version: 0.9.19-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerabilities were published for xrdp.
CVE-2022-23468[0]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create()
| function. There are no known workarounds for this issue. Users are
| advised to upgrade.
CVE-2022-23477[1]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a buffer over flow in audin_send_open() function.
| There are no known workarounds for this issue. Users are advised to
| upgrade.
CVE-2022-23478[2]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Out of Bound Write in
| xrdp_mm_trans_process_drdynvc_channel_open() function. There are no
| known workarounds for this issue. Users are advised to upgrade.
CVE-2022-23479[3]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in()
| function. There are no known workarounds for this issue. Users are
| advised to upgrade.
CVE-2022-23480[4]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a buffer over flow in
| devredir_proc_client_devlist_announce_req() function. There are no
| known workarounds for this issue. Users are advised to upgrade.
CVE-2022-23481[5]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Out of Bound Read in
| xrdp_caps_process_confirm_active() function. There are no known
| workarounds for this issue. Users are advised to upgrade.
CVE-2022-23482[6]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Out of Bound Read in
| xrdp_sec_process_mcs_data_CS_CORE() function. There are no known
| workarounds for this issue. Users are advised to upgrade.
CVE-2022-23483[7]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel()
| function. There are no known workarounds for this issue. Users are
| advised to upgrade.
CVE-2022-23484[8]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Integer Overflow in
| xrdp_mm_process_rail_update_window_text() function. There are no known
| workarounds for this issue. Users are advised to upgrade.
CVE-2022-23493[9]:
| xrdp is an open source project which provides a graphical login to
| remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp
| < v0.9.21 contain a Out of Bound Read in
| xrdp_mm_trans_process_drdynvc_channel_close() function. There are no
| known workarounds for this issue. Users are advised to upgrade.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-23468
https://www.cve.org/CVERecord?id=CVE-2022-23468
[1] https://security-tracker.debian.org/tracker/CVE-2022-23477
https://www.cve.org/CVERecord?id=CVE-2022-23477
[2] https://security-tracker.debian.org/tracker/CVE-2022-23478
https://www.cve.org/CVERecord?id=CVE-2022-23478
[3] https://security-tracker.debian.org/tracker/CVE-2022-23479
https://www.cve.org/CVERecord?id=CVE-2022-23479
[4] https://security-tracker.debian.org/tracker/CVE-2022-23480
https://www.cve.org/CVERecord?id=CVE-2022-23480
[5] https://security-tracker.debian.org/tracker/CVE-2022-23481
https://www.cve.org/CVERecord?id=CVE-2022-23481
[6] https://security-tracker.debian.org/tracker/CVE-2022-23482
https://www.cve.org/CVERecord?id=CVE-2022-23482
[7] https://security-tracker.debian.org/tracker/CVE-2022-23483
https://www.cve.org/CVERecord?id=CVE-2022-23483
[8] https://security-tracker.debian.org/tracker/CVE-2022-23484
https://www.cve.org/CVERecord?id=CVE-2022-23484
[9] https://security-tracker.debian.org/tracker/CVE-2022-23493
https://www.cve.org/CVERecord?id=CVE-2022-23493
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: xrdp
Source-Version: 0.9.21.1-1
Done: Dominik George <natureshadow@debian.org>
We believe that the bug you reported is fixed in the latest version of
xrdp, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1025879@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Dominik George <natureshadow@debian.org> (supplier of updated xrdp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Dec 2022 11:09:50 +0100
Source: xrdp
Architecture: source
Version: 0.9.21.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org>
Changed-By: Dominik George <natureshadow@debian.org>
Closes: 1025879
Changes:
xrdp (0.9.21.1-1) unstable; urgency=medium
.
* New upstream version. (Closes: #1025879)
+ Refresh patches.
+ Refresh d/copyright.
* Bump Standards-Version to 4.6.2; no changes needed.
Checksums-Sha1:
f5791701c6bd3eed79d6d799706812b80ec29315 1699 xrdp_0.9.21.1-1.dsc
722bc19b691fff23e0f24548dce80df99ba5628c 2053402 xrdp_0.9.21.1.orig.tar.gz
2d1b6d98ddb3f4b822bda44f2acc02efef16abb6 22848 xrdp_0.9.21.1-1.debian.tar.xz
c5ca514e9c2759521400bc5b3d8b07c3dd3325c2 7206 xrdp_0.9.21.1-1_amd64.buildinfo
Checksums-Sha256:
b3d2909e7917821127a1b08487da9f27555781d923f7d769463ca25174c7e8ac 1699 xrdp_0.9.21.1-1.dsc
7c6c42dce7d3201efe4481e0d388e00094bf8f15224ddad9e47b402a672e08e3 2053402 xrdp_0.9.21.1.orig.tar.gz
aca90d00d6af356df5b7f22e8b29c55a95516165fb94f38feff59c99c02c5e0c 22848 xrdp_0.9.21.1-1.debian.tar.xz
c7045ff900077183e32ac8ea8e3e532a0fe04a037ab2bb9e197345dd099b1806 7206 xrdp_0.9.21.1-1_amd64.buildinfo
Files:
a2411483c897e9861eaf5bd69226288e 1699 net optional xrdp_0.9.21.1-1.dsc
32a4b1589f051fc69cde698f7225e095 2053402 net optional xrdp_0.9.21.1.orig.tar.gz
73b2f20e0cf2207880886d2c8c8213f1 22848 net optional xrdp_0.9.21.1-1.debian.tar.xz
aa6acf152eccd7641b0898e8774c83b1 7206 net optional xrdp_0.9.21.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iKcEARYKAE8WIQSk6zxRYJYchegBkTEK5VTlRg4b3QUCY6GPSzEaaHR0cHM6Ly93
d3cuZG9taW5pay1nZW9yZ2UuZGUvZ3BnLXBvbGljeS50eHQuYXNjAAoJEArlVOVG
Dhvd+hMA/iKK/AWITsBG3b5X/gtH3zyyVOSbHtm5T6612WdsM5m9AQDwH+rEkalJ
0XN9Ngr07Q1yGAWNLc8daBNRAsPMCYKIAw==
=i1M6
-----END PGP SIGNATURE-----
--- End Message ---
Reply to: