CVE catalog

CVE-2023-42822

xrdp vulnerabilities

Severity: Medium · CVSS 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Published: Sep 27, 2023, 6:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.74% · Oct 25, 2026

xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	xrdp	sid	`0.10.6.1-3`	fixed
Debian	xrdp	forky	`0.10.6.1-3`	fixed
Debian	xrdp	trixie	`0.10.1-3.1+deb13u2`	fixed
Debian	xrdp	trixie-security	`0.10.1-3.1+deb13u2`	fixed
Debian	xrdp	bookworm	`0.9.21.1-1+deb12u2`	fixed
Debian	xrdp	bookworm-security	`0.9.21.1-1+deb12u3`	fixed
Ubuntu	xrdp	noble	`0.9.24-4ubuntu0.1~esm1`	fixed
Ubuntu	xrdp	noble	`0.9.21.1-1+deb12u1`	fixed
Ubuntu	xrdp	pro	`0.9.21.1-1`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-2`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-3`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-3build1`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-3build2`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-4`	vulnerable
Ubuntu	xrdp	pro	`0.9.24-4ubuntu0.1~esm1`	fixed
Suse	xrdp	linux enterprise module for basesystem 15 sp4	`0.9.13.1-150200.4.27.1`	fixed
Suse	xrdp	linux enterprise module for basesystem 15 sp5	`0.9.13.1-150200.4.27.1`	fixed
Opensuse	xrdp	leap 15.4	`0.9.13.1-150200.4.27.1`	fixed
Opensuse	xrdp	leap 15.5	`0.9.13.1-150200.4.27.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	xrdp	source	sid	`0.9.24-2`	not yet assigned	Not reported	[1053284]
Debian	xrdp	source	forky	`0.9.24-2`	not yet assigned	Not reported	[1053284]
Debian	xrdp	source	trixie	`0.9.24-2`	not yet assigned	Not reported	[1053284]
Debian	xrdp	source	bookworm	`0.9.21.1-1+deb12u1`	not yet assigned	Not reported	[1053284]
Ubuntu	xrdp	deb	noble	`0.9.24-4ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	xrdp	deb	noble	`0.9.21.1-1+deb12u1`	Not reported	Not reported	Not reported
Ubuntu	xrdp	deb	pro	`0.9.24-4ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2023-42822	Not reported
Suse	xrdp	rpm	linux enterprise module for basesystem 15 sp4	`0.9.13.1-150200.4.27.1`	Not reported	SUSE-SU-2023:4577-1	Not reported
Suse	xrdp	rpm	linux enterprise module for basesystem 15 sp5	`0.9.13.1-150200.4.27.1`	Not reported	SUSE-SU-2023:4577-1	Not reported
Opensuse	xrdp	rpm	leap 15.4	`0.9.13.1-150200.4.27.1`	Not reported	SUSE-SU-2023:4577-1	Not reported
Opensuse	xrdp	rpm	leap 15.5	`0.9.13.1-150200.4.27.1`	Not reported	SUSE-SU-2023:4577-1	Not reported

[Debian bug #1053284]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]