rpm package
opensuse/xrdp&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/xrdp&distro=openSUSE%20Tumbleweed
Vulnerabilities (36)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-55639 | Med | 5.3 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and secur | |
| CVE-2026-55626 | Hig | 8.0 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could explo | |
| CVE-2026-55645 | Med | 6.5 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network | |
| CVE-2026-55238 | Med | 5.3 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, | |
| CVE-2026-54538 | Hig | 7.5 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulner | |
| CVE-2026-44978 | Med | 5.3 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer | |
| CVE-2026-44178 | Hig | 8.8 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer | |
| CVE-2026-42218 | Med | 5.3 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized infor | |
| CVE-2026-41521 | Hig | 8.2 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during | |
| CVE-2026-41252 | Cri | 9.8 | < 0.10.6.1-1.1 | 0.10.6.1-1.1 | Jul 20, 2026 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming | |
| CVE-2026-35512 | Hig | 8.8 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-au | |
| CVE-2026-33689 | Cri | 9.1 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial | |
| CVE-2026-33145 | Med | 6.3 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default w | |
| CVE-2026-32624 | Med | 6.5 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long us | |
| CVE-2026-32623 | Hig | 8.1 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channe | |
| CVE-2026-32107 | Hig | 8.8 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and exe | |
| CVE-2026-32105 | Hig | 7.7 | < 0.9.27-2.1 | 0.9.27-2.1 | Apr 17, 2026 | xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the recei | |
| CVE-2025-68670 | Cri | 9.1 | < 0.9.27-1.1 | 0.9.27-1.1 | Jan 27, 2026 | xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability coul | |
| CVE-2024-39917 | Hig | 7.2 | < 0.9.27-2.1 | 0.9.27-2.1 | Jul 12, 2024 | xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman. | |
| CVE-2023-42822 | Med | 4.6 | < 0.9.23.1-1.1 | 0.9.23.1-1.1 | Sep 27, 2023 | xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of- |
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and secur
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could explo
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote,
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulner
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized infor
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during
- affected < 0.10.6.1-1.1fixed 0.10.6.1-1.1
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-au
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default w
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long us
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channe
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and exe
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the recei
- affected < 0.9.27-1.1fixed 0.9.27-1.1
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability coul
- affected < 0.9.27-2.1fixed 0.9.27-2.1
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.
- affected < 0.9.23.1-1.1fixed 0.9.23.1-1.1
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-
Page 1 of 2