-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 28 Aug 2026 10:18:38 +0530 Source: xrdp Architecture: source Version: 0.9.21.1-1~deb11u4 Distribution: bullseye-security Urgency: high Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org> Changed-By: Abhijith PA <abhijith@debian.org> Closes: 1134339 Changes: xrdp (0.9.21.1-1~deb11u4) bullseye-security; urgency=high . * Non-maintainer upload by the Debian LTS Team. * CVE-CVE-2026-32105: modify encrypted traffic in transit without detection (Closes: #1134339) * CVE-2026-32107: improper privilege management allow attacker to escalate privileges to root and execute arbitrary code. * CVE-2026-32623: heap-based buffer overflow vulnerability * CVE-2026-32624: heap-based buffer overflow vulnerability * CVE-2026-33516: out-of-bounds read vulnerability * CVE-2026-33689: out-of-bounds read vulnerability * CVE-2026-41252: missing bounds check in xrdp, which allows a heap-based buffer overflow * CVE-2026-41521: nteger overflow vulnerability * CVE-2026-44178: heap-based buffer overflow vulnerability * CVE-2026-44978: heap out-of-bounds read vulnerability * CVE-2026-54538: sending a specially crafted packet that forces the process into an infinite, CPU-bound loop * CVE-2026-55238: Denial of Service * CVE-2026-55639: exploit by specially crafted RDP malformed data and read out-of-bound data block. * CVE-2026-55645: out-of-bounds memory reads Checksums-Sha1: 930bda690b484c7da73bae34591ddcb90f62b92d 2296 xrdp_0.9.21.1-1~deb11u4.dsc 316887bd4d830ddf99923d978815d92f04942dc6 38464 xrdp_0.9.21.1-1~deb11u4.debian.tar.xz Checksums-Sha256: 8ad4a4c91a2c0463f64c8c2d3de3ea9de63cf3f17d5321db897926c21428c68f 2296 xrdp_0.9.21.1-1~deb11u4.dsc eb4b4ca3c4dc9548049cf522007ce75bd1dcc78eb4d297fedcf5695beb0d00d2 38464 xrdp_0.9.21.1-1~deb11u4.debian.tar.xz Files: 206b1b69d8120c42a122a6035640b621 2296 net optional xrdp_0.9.21.1-1~deb11u4.dsc 440d86fa70499e9fda099437560f7507 38464 net optional xrdp_0.9.21.1-1~deb11u4.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAmqSSNkUHGFiaGlqaXRo QGRlYmlhbi5vcmcACgkQhj1N8u2cKO+7Qw/8Cqdv3E2tR6n1+7P4A5EJ33mkpMG3 2OND0GSCdHD7zFw+3pFKAVW5eF332BX5G20wkz+hebzikA7ZKUXlyhlwph2/88pe zUukcJFWHQrmCqlcRxrjKkokRDzU68m+7RH6YkZJt6eAHUoBd/2gxQqgDf9YL+8x WxPTFg2IZMNYOEp9qwdl16tF4C79aErga7Gm/YBVLp0jU58hBZW3YOCRjJ2e92Wf u/P7uedHLsTUoJT9dAplwESElYbigjS3lZwsvLmW/IVRCWFONyZHfz830XUlUX/x UzCje09J89SPBv7oWIMdA1+OzSVtCxexlgAToFPMUdYNRuSPzkwWYV6vsDtjRqv/ Vis83YCkQxcjs6oDN7gSw6YTYvhBQAf5uYOak6ZzXY2gafiSiRNdDBw75jjUboNP rOZuJv0J8cDJFNbcAfhldhfxo2UoHsiJdPrEHLigerFbvqC+vHJQiaeLh1DbcgXC WaxqLVWgfdzTzlB+sPFvryTzRs1oOGXqSbeyFthy7Y4HWxPOmG3oipNKyNTHCrNd hVeiqIdBv751pcW/m+igbN7JIJJ/2e8RHtbVh7jqNsvmG0e1wcMhjsBSOuj0WQPH OTF5YFDhCRXwcXVZrr0rm2PirDTbMzVc6t0P6d5bPyrjcXX0tzFs7P+0BJaT9344 NvmbR5yd+Hu2fMQ= =meID -----END PGP SIGNATURE-----
