-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 26 Aug 2026 17:41:47 +0530 Source: xrdp Architecture: source Version: 0.9.21.1-1+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org> Changed-By: Abhijith PA <abhijith@debian.org> Closes: 1134339 Changes: xrdp (0.9.21.1-1+deb12u3) bookworm-security; urgency=high . * Non-maintainer upload by the Debian LTS Team. * CVE-CVE-2026-32105: modify encrypted traffic in transit without detection (Closes: #1134339) * CVE-2026-32107: improper privilege management allow attacker to escalate privileges to root and execute arbitrary code. * CVE-2026-32623: heap-based buffer overflow vulnerability * CVE-2026-32624: heap-based buffer overflow vulnerability * CVE-2026-33516: out-of-bounds read vulnerability * CVE-2026-33689: out-of-bounds read vulnerability * CVE-2026-41252: missing bounds check in xrdp, which allows a heap-based buffer overflow * CVE-2026-41521: nteger overflow vulnerability * CVE-2026-44178: heap-based buffer overflow vulnerability * CVE-2026-44978: heap out-of-bounds read vulnerability * CVE-2026-54538: sending a specially crafted packet that forces the process into an infinite, CPU-bound loop * CVE-2026-55238: Denial of Service * CVE-2026-55639: exploit by specially crafted RDP malformed data and read out-of-bound data block. * CVE-2026-55645: out-of-bounds memory reads Checksums-Sha1: e2b6cd2692aa04804f80b741de9b7bd32fc8b60d 2296 xrdp_0.9.21.1-1+deb12u3.dsc 8baddc5a5b9d69e7837293d244b9741ea8e92d38 38552 xrdp_0.9.21.1-1+deb12u3.debian.tar.xz Checksums-Sha256: 318663ea47de6b1ebab77773e72d1c63ba3599b6aa05adff11cf80d6c8e9193f 2296 xrdp_0.9.21.1-1+deb12u3.dsc 1d22cd850e08fec7877b25cc136aeb25e413fb11594f21acf97604611e2617de 38552 xrdp_0.9.21.1-1+deb12u3.debian.tar.xz Files: df97ffea91f57475291ff2424a6e78fd 2296 net optional xrdp_0.9.21.1-1+deb12u3.dsc a94d458d4857ac9e72c1e8412c362485 38552 net optional xrdp_0.9.21.1-1+deb12u3.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAmqSSIEUHGFiaGlqaXRo QGRlYmlhbi5vcmcACgkQhj1N8u2cKO+siQ//eiXyKk361AlkB4LoXy7S+qrmb0Cu FGfwXkHDXxwSE44iu7aNNfVj2Mv35DO89kYQP8ndGxAxnfRr+WRmmRC4rGq+APmz IWdXYw9n4hlhsP3wq1h0ydxC/6ZkerBYdhMM68llhcywQSrMfGkOXQF8m0pDfe7L GK3IjlxqbqTsi4ysbiRuKH3OBhPyx/l7xBK0wA8txDSZf0paYagqg72QxpCvtf9h k7Uh0hrhkQkYhuoqgostpOISu3/wjDPzNP3cxCRzWKBwTvJQQ9dMjSDn1XIo9daN TzRVRNhB82bZD46Bqhur6OnOHxpE798ULk7afUKjCw/AhsPwgpHbxBoZc/MvCgaR w8UE8CjdHJWE168wqnM7O0e20yGHYjGtFyfQZRjCJ+tagLbo4jK1N7lKTCeMdze0 r03EVHBz3n8msWFk2HUCJXi3a56a5Tq5fMyeil2EKLbAfcjAKhv+pHz1x09a6Ybw Tq93Xjt7sgsg0M4s11XIYdLWPi7xhkCdoBCnc0+0UFnuZNlyuEbeawj02DdFXgEl Z+cGraMFmT/UXNIt5+KAkrSYYZuKRYQrh88YzHP6nBEK7KXS+IA/GzSK49+qgfzZ li2a3XOwREIvXlqHDPWCcskmahF7eoXJHtJhRX0X4FoxMxadfZaRGffeHk3ED5P7 Odc0ugPSvJGCHoE= =hrAW -----END PGP SIGNATURE-----
