{"id":"USN-6474-1","summary":"xrdp vulnerabilities","details":"It was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,\nCVE-2023-42822)\n\nIt was discovered that xrdp improperly handled session establishment\nerrors. An attacker could potentially use this issue to bypass the\nOS-level session restrictions by PAM. (CVE-2023-40184)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23478)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)\n","modified":"2026-04-24T09:43:50.404370Z","published":"2023-11-08T13:47:00Z","related":["UBUNTU-CVE-2022-23468","UBUNTU-CVE-2022-23477","UBUNTU-CVE-2022-23478","UBUNTU-CVE-2022-23479","UBUNTU-CVE-2022-23480","UBUNTU-CVE-2022-23481","UBUNTU-CVE-2022-23482","UBUNTU-CVE-2022-23483","UBUNTU-CVE-2022-23484","UBUNTU-CVE-2022-23493","UBUNTU-CVE-2022-23613","UBUNTU-CVE-2023-40184","UBUNTU-CVE-2023-42822"],"upstream":["CVE-2022-23468","CVE-2022-23477","CVE-2022-23478","CVE-2022-23479","CVE-2022-23480","CVE-2022-23481","CVE-2022-23482","CVE-2022-23483","CVE-2022-23484","CVE-2022-23493","CVE-2022-23613","CVE-2023-40184","CVE-2023-42822","UBUNTU-CVE-2022-23468","UBUNTU-CVE-2022-23477","UBUNTU-CVE-2022-23478","UBUNTU-CVE-2022-23479","UBUNTU-CVE-2022-23480","UBUNTU-CVE-2022-23481","UBUNTU-CVE-2022-23482","UBUNTU-CVE-2022-23483","UBUNTU-CVE-2022-23484","UBUNTU-CVE-2022-23493","UBUNTU-CVE-2022-23613","UBUNTU-CVE-2023-40184","UBUNTU-CVE-2023-42822"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6474-1"}],"affected":[{"package":{"name":"xrdp","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/xrdp@0.6.0-1ubuntu0.1+esm3?arch=source&distro=trusty/esm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1ubuntu0.1+esm3"}]}],"versions":["0.6.0-1","0.6.0-1ubuntu0.1","0.6.0-1ubuntu0.1+esm1","0.6.0-1ubuntu0.1+esm2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.6.0-1ubuntu0.1+esm3","binary_name":"xrdp"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:14.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6474-1.json"}},{"package":{"name":"xrdp","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/xrdp@0.6.1-2ubuntu0.3+esm3?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.3+esm3"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.1","0.6.1-2ubuntu0.3","0.6.1-2ubuntu0.3+esm1","0.6.1-2ubuntu0.3+esm2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.6.1-2ubuntu0.3+esm3","binary_name":"xrdp"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6474-1.json"}},{"package":{"name":"xrdp","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/xrdp@0.9.5-2ubuntu0.1~esm2?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm2"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.5-2ubuntu0.1~esm2","binary_name":"xorgxrdp"},{"binary_version":"0.9.5-2ubuntu0.1~esm2","binary_name":"xrdp"},{"binary_version":"0.9.5-2ubuntu0.1~esm2","binary_name":"xrdp-pulseaudio-installer"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6474-1.json"}},{"package":{"name":"xrdp","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/xrdp@0.9.12-1ubuntu0.1+esm1?arch=source&distro=esm-apps/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.12-1ubuntu0.1+esm1","binary_name":"xrdp"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6474-1.json"}},{"package":{"name":"xrdp","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/xrdp@0.9.17-2ubuntu2+esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu2+esm1"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.9.17-2ubuntu2+esm1","binary_name":"xrdp"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6474-1.json"}}],"schema_version":"1.7.5"}