CVE-2023-42822
published 2023-09-27CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.63%
45.6th percentile
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xrdp | < xrdp 0.9.21.1-1+deb12u1 (bookworm) | xrdp 0.9.21.1-1+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| neutrinolabs | xrdp | < 0.9.23.1 | 0.9.23.1 |
| neutrinolabs | xrdp | >= 0 < 0.9.21.1-1~deb11u2 | 0.9.21.1-1~deb11u2 |
| neutrinolabs | xrdp | >= 0 < 0.9.21.1-1+deb12u1 | 0.9.21.1-1+deb12u1 |
| neutrinolabs | xrdp | >= 0 < 0.9.24-2 | 0.9.24-2 |
| neutrinolabs | xrdp | >= 0 < 0.9.24-2 | 0.9.24-2 |
| neutrinolabs | xrdp | >= 0 < 0.6.0-1ubuntu0.1+esm3 | 0.6.0-1ubuntu0.1+esm3 |
| neutrinolabs | xrdp | >= 0 < 0.6.1-2ubuntu0.3+esm3 | 0.6.1-2ubuntu0.3+esm3 |
| neutrinolabs | xrdp | >= 0 < 0.9.5-2ubuntu0.1~esm2 | 0.9.5-2ubuntu0.1~esm2 |
| neutrinolabs | xrdp | >= 0 < 0.9.12-1ubuntu0.1+esm1 | 0.9.12-1ubuntu0.1+esm1 |
| neutrinolabs | xrdp | >= 0 < 0.9.17-2ubuntu2+esm1 | 0.9.17-2ubuntu2+esm1 |
| ubuntu | xrdp | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv9.8CRITICAL
vendor_ubuntu6.5MEDIUM
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
xrdp vulnerabilities
osv·2023-11-08·CVSS 9.8
CVE-2022-23479 [CRITICAL] xrdp vulnerabilities
xrdp vulnerabilities
It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,
CVE-2023-42822)
It was discovered that xrdp improperly handled session establishment
errors. An attacker could potentially use this issue to bypass the
OS-level session restrictions by PAM. (CVE-2023-40184)
It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04
OSV
CVE-2023-42822: xrdp is an open source remote desktop protocol server
osv·2023-09-27·CVSS 6.5
CVE-2023-42822 [MEDIUM] CVE-2023-42822: xrdp is an open source remote desktop protocol server
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Ubuntu
xrdp vulnerabilities
vendor_ubuntu·2026-06-25·CVSS 6.5
CVE-2023-40184 [MEDIUM] xrdp vulnerabilities
Title: xrdp vulnerabilities
Summary: Several security issues were fixed in xrdp.
It was discovered that xrdp incorrectly handled bounds checking when
processing user domain information during the connection sequence. An
unauthenticated remote attacker could use this issue to cause xrdp to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-68670)
It was discovered that xrdp did not correctly enforce the maximum number of
login attempts configured by the MaxLoginRetry parameter. A remote attacker
could use this issue to perform an unlimited number of login attempts.
(CVE-2024-39917)
It was discovered that xrdp did not perform bounds checking when accessing
font glyphs. Since some of this data is controllable by the user, a remote
attacker could use thi
Ubuntu
xrdp vulnerabilities
vendor_ubuntu·2023-11-08·CVSS 6.5
CVE-2022-23468 [MEDIUM] xrdp vulnerabilities
Title: xrdp vulnerabilities
Summary: Several security issues were fixed in xrdp.
It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds reads. An attacker
could possibly use this issue to crash the program or extract sensitive
information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,
CVE-2023-42822)
It was discovered that xrdp improperly handled session establishment
errors. An attacker could potentially use this issue to bypass the
OS-level session restrictions by PAM. (CVE-2023-40184)
It was discovered that xrdp incorrectly handled validation of
client-supplied data, which could lead to out-of-bounds writes. An attacker
could possibly use this issue to cause memory corruption or execute
arbitrary code. This issue only
Debian
CVE-2023-42822: xrdp - xrdp is an open source remote desktop protocol server. Access to the font glyphs...
vendor_debian·2023·CVSS 4.6
CVE-2023-42822 [MEDIUM] CVE-2023-42822: xrdp - xrdp is an open source remote desktop protocol server. Access to the font glyphs...
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scope: local
bookworm: resolved (fixed in 0.9.21.1-1+deb12u1)
bullseye: resolved (fixed in 0.9.21.1-1~deb11u2)
forky: resolved (
No detection rules found.
No public exploits indexed.
https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hwhttps://lists.fedoraproject.org/archives/list/[email protected]/message/5FPGA4M7IYCP7OILDF2ZJEVSXUOFEFQ6/https://lists.fedoraproject.org/archives/list/[email protected]/message/PFGL22QQF65OIZRMCKUZCVJQCKGUBRYE/https://lists.fedoraproject.org/archives/list/[email protected]/message/RTXODUR4ILM7ZPA6ZGY6VSK4BBSBMKGY/https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hwhttps://lists.debian.org/debian-lts-announce/2025/05/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/5FPGA4M7IYCP7OILDF2ZJEVSXUOFEFQ6/https://lists.fedoraproject.org/archives/list/[email protected]/message/PFGL22QQF65OIZRMCKUZCVJQCKGUBRYE/https://lists.fedoraproject.org/archives/list/[email protected]/message/RTXODUR4ILM7ZPA6ZGY6VSK4BBSBMKGY/
2023-09-27
Published