CVE-2022-23479: Buffer Overflow occurs in xrdp
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdpmmchandatain() function. There are no known workarounds for this issue. Users are advised to upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1+deb12u2Fixed in 0.9.21.1-1+deb12u3Fixed in 0.10.1-3.1+deb13u2Fixed in 0.10.6.1-3 - Upgrade
Upgrade
alpine/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-r0 - Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.9.21
Event History
Frequently Asked Questions
What is CVE-2022-23479?
CVE-2022-23479 is a vulnerability in the xrdp open source project, allowing remote attackers to conduct a buffer overflow attack.
What is the severity of CVE-2022-23479?
The severity of CVE-2022-23479 is critical with a severity score of 9.8 out of 10.
How does CVE-2022-23479 impact xrdp?
CVE-2022-23479 impacts xrdp by allowing remote attackers to trigger a buffer overflow in the xrdp_mm_chan_data_in() function.
Is there a workaround for CVE-2022-23479?
There are no known workarounds for CVE-2022-23479, users are advised to upgrade to a fixed version.
How can I fix CVE-2022-23479?
To fix CVE-2022-23479, users are advised to upgrade to a version of xrdp that is greater than or equal to 0.9.21.