CVE-2022-23477: Buffer Overflow in xrdp

Q: What is CVE-2022-23477?

CVE-2022-23477 is a vulnerability in xrdp, an open source project that provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).

Q: What is the severity of CVE-2022-23477?

The severity of CVE-2022-23477 is critical with a CVSS score of 9.8.

Q: How does CVE-2022-23477 affect xrdp?

CVE-2022-23477 affects xrdp versions earlier than v0.9.21 and may result in a buffer overflow in the audin_send_open() function.

Q: How can I fix CVE-2022-23477?

To fix CVE-2022-23477, users are advised to upgrade xrdp to a version later than v0.9.21.

Q: Are there any workarounds for CVE-2022-23477?

There are no known workarounds for CVE-2022-23477.

Published Dec 9, 2022

Updated

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audinsendopen() function. There are no known workarounds for this issue. Users are advised to upgrade.

Affected Software

3 affected componentsFixes available

debian/xrdp

0.9.9-1+deb10u10.9.9-1+deb10u30.9.21.1-1~deb11u10.9.21.1-1

Neutrinolabs Xrdp<0.9.21

Debian Debian Linux=11.0

Event History

Dec 9, 2022

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-23477?

CVE-2022-23477 is a vulnerability in xrdp, an open source project that provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).

What is the severity of CVE-2022-23477?

The severity of CVE-2022-23477 is critical with a CVSS score of 9.8.

How does CVE-2022-23477 affect xrdp?

CVE-2022-23477 affects xrdp versions earlier than v0.9.21 and may result in a buffer overflow in the audin_send_open() function.

How can I fix CVE-2022-23477?

To fix CVE-2022-23477, users are advised to upgrade xrdp to a version later than v0.9.21.

Are there any workarounds for CVE-2022-23477?