CVE-2018-8798: High severity rdesktop RDesktop vulnerability
Published Feb 5, 2019
·Updated
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsndprocessping() that results in an information leak.
Affected Software
19 affected componentsFixes available
debian/rdesktop
1.8.6-21.9.0-2
rdesktop RDesktop<=1.8.3
Debian Debian Linux=8.0
Debian Debian Linux=9.0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
alpine/rdesktop<1.8.6-r0
1.8.6-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rdesktopto a version that resolves this vulnerability.Fixed in 1.8.6-2Fixed in 1.9.0-2 - Upgrade
Upgrade
alpine/rdesktopto a version that resolves this vulnerability.Fixed in 1.8.6-r0
Event History
Feb 5, 2019
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Data Sourced
via NVD·08:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·08:29 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-8798?
CVE-2018-8798 has a medium severity rating due to the potential for information leaks.
2
How do I fix CVE-2018-8798?
To fix CVE-2018-8798, update rdesktop to version 1.8.6-2 or later.
3
Which versions of rdesktop are affected by CVE-2018-8798?
rdesktop versions up to and including 1.8.3 are affected by CVE-2018-8798.
4
What type of vulnerability is CVE-2018-8798?
CVE-2018-8798 is an Out-Of-Bounds Read vulnerability.
5
What can an attacker achieve with CVE-2018-8798?
An attacker could exploit CVE-2018-8798 to leak sensitive information from the application.