CVE-2022-23478: Out of Bound Write in xrdp

Q: What is CVE-2022-23478?

CVE-2022-23478 is a vulnerability in xrdp version <0.9.21 that allows for an out-of-bounds write in the xrdp_mm_trans_process_drdynvc_channel_open() function.

Q: How does CVE-2022-23478 affect xrdp?

CVE-2022-23478 affects xrdp versions prior to 0.9.21.

Q: What is xrdp?

xrdp is an open source project that provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).

Q: What is the severity of CVE-2022-23478?

The severity of CVE-2022-23478 is critical with a CVSS score of 9.8.

Q: How can I fix CVE-2022-23478?

To fix CVE-2022-23478, users should update xrdp to version 0.9.21 or higher.

Published Dec 9, 2022

Updated

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdpmmtransprocessdrdynvcchannelopen() function. There are no known workarounds for this issue. Users are advised to upgrade.

Affected Software

3 affected componentsFixes available

debian/xrdp<=0.9.9-1+deb10u1

0.9.9-1+deb10u30.9.21.1-1~deb11u10.9.21.1-1

Neutrinolabs Xrdp<0.9.21

Debian Debian Linux=11.0

Event History

Dec 9, 2022

CVE Published

via MITRE·05:49 PM

Data Sourced

via MITRE·05:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-23478?

CVE-2022-23478 is a vulnerability in xrdp version <0.9.21 that allows for an out-of-bounds write in the xrdp_mm_trans_process_drdynvc_channel_open() function.

How does CVE-2022-23478 affect xrdp?

CVE-2022-23478 affects xrdp versions prior to 0.9.21.

What is xrdp?

xrdp is an open source project that provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).

What is the severity of CVE-2022-23478?

The severity of CVE-2022-23478 is critical with a CVSS score of 9.8.

How can I fix CVE-2022-23478?