rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processbmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processrawbmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function processdemandactive() that results in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdpinunistr() and results in memory corruption and possibly even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspciprocess() and results in memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbgprocess() and results in memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamlessprocess() and results in memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamlessprocessline() that results in memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function uicliphandledata() that results in an information leak.

rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function uicliphandledata() that results in a memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function processplane() that results in a memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function processbitmapupdates() and results in a memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function processbitmapupdates() that results in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsndprocessping() that results in an information leak.

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function processsecondaryorder() that results in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdrprocess() that results in an information leak.

rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function csspreadtsrequest() that results in a memory corruption and probably even a remote code execution.

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function csspreadtsrequest() that results in a Denial of Service (segfault).

rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function processbitmapupdates() and results in a memory corruption and possibly even a remote code execution.