Debian Package Tracker
Register | Log in
Subscribe

xrdp

Remote Desktop Protocol (RDP) server

Choose email to subscribe with

general
  • source: xrdp (main)
  • version: 0.9.21.1-1
  • maintainer: Debian Remote Maintainers (archive) (DMD)
  • uploaders: Thorsten Glaser [DMD] – Mike Gabriel [DMD] – Dominik George [DMD]
  • arch: any
  • std-ver: 4.6.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 0.9.9-1+deb10u1
  • o-o-sec: 0.9.9-1+deb10u3
  • oldstable: 0.9.12-1.1
  • old-sec: 0.9.21.1-1~deb11u1
  • old-p-u: 0.9.21.1-1~deb11u1
  • stable: 0.9.21.1-1
  • testing: 0.9.21.1-1
  • unstable: 0.9.21.1-1
versioned links
  • 0.9.9-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.9.9-1+deb10u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.9.12-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.9.21.1-1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 0.9.21.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • xrdp (19 bugs: 1, 16, 2, 0)
action needed
Problems while searching for a new upstream version high
uscan had problems while searching for a new upstream version:
In debian/watch no matching files for watch line
  https://github.com/neutrinolabs/xrdp/releases .*/xrdp(?:[-_]?(\d[\-+\.:\~\da-zA-Z]*))(?i)(?:\.(?:tar\.xz|tar\.bz2|tar\.gz|tar\.zstd?|zip|tgz|tbz|txz))
Created: 2022-09-13 Last update: 2023-09-29 09:36
2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:
  • CVE-2023-40184: xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
  • CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Created: 2023-08-31 Last update: 2023-09-29 03:38
2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:
  • CVE-2023-40184: xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
  • CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Created: 2023-08-31 Last update: 2023-09-29 03:38
2 security issues in buster high

There are 2 open security issues in buster.

1 important issue:
  • CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
1 issue postponed or untriaged:
  • CVE-2023-40184: (needs triaging) xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
Created: 2023-09-27 Last update: 2023-09-29 03:38
2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:
  • CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
1 issue left for the package maintainer to handle:
  • CVE-2023-40184: (needs triaging) xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.

You can find information about how to handle this issue in the security team's documentation.

Created: 2022-12-16 Last update: 2023-09-29 03:38
2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:
  • CVE-2023-42822: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
1 issue left for the package maintainer to handle:
  • CVE-2023-40184: (needs triaging) xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-08-31 Last update: 2023-09-29 03:38
lintian reports 9 errors and 3 warnings high
Lintian reports 9 errors and 3 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2022-12-21 Last update: 2023-09-03 06:07
debian/patches: 2 patches with invalid metadata, 2 patches to forward upstream high

Among the 9 debian patches available in version 0.9.21.1-1 of the package, we noticed the following issues:

  • 2 patches with invalid metadata that ought to be fixed.
  • 2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2023-02-26 15:54
4 bugs tagged patch in the BTS normal
The BTS contains patches fixing 4 bugs, consider including or untagging them.
Created: 2023-09-13 Last update: 2023-09-29 14:37
news
[rss feed]
  • [2023-09-23] Accepted xrdp 0.9.21.1-1~deb11u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
  • [2023-09-18] Accepted xrdp 0.9.21.1-1~deb11u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Markus Koschany)
  • [2023-03-31] Accepted xrdp 0.9.9-1+deb10u3 (source amd64) into oldstable (Chris Lamb)
  • [2023-03-27] Accepted xrdp 0.9.9-1+deb10u2 (source) into oldstable (Dominik George)
  • [2022-12-29] xrdp 0.9.21.1-1 MIGRATED to testing (Debian testing watch)
  • [2022-12-20] Accepted xrdp 0.9.21.1-1 (source) into unstable (Dominik George)
  • [2022-06-11] xrdp 0.9.19-1 MIGRATED to testing (Debian testing watch)
  • [2022-04-01] Accepted xrdp 0.9.19-1 (source) into unstable (Dominik George)
  • [2022-04-01] Accepted xrdp 0.9.17-2.1 (source) into unstable (Arnaud Rebillout) (signed by: Raphaël Hertzog)
  • [2022-03-28] xrdp REMOVED from testing (Debian testing watch)
  • [2021-11-03] xrdp 0.9.17-2 MIGRATED to testing (Debian testing watch)
  • [2021-10-28] Accepted xrdp 0.9.17-2 (source) into unstable (Thorsten Glaser)
  • [2021-10-05] xrdp 0.9.17-1 MIGRATED to testing (Debian testing watch)
  • [2021-09-29] Accepted xrdp 0.9.17-1 (source) into unstable (Dominik George)
  • [2021-03-01] Accepted xrdp 0.9.15-1 (source) into unstable (Dominik George)
  • [2020-08-09] Accepted xrdp 0.9.1-9+deb9u4 (source amd64) into oldstable (Abhijith PA)
  • [2020-08-01] Accepted xrdp 0.9.9-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2020-07-31] xrdp 0.9.12-1.1 MIGRATED to testing (Debian testing watch)
  • [2020-07-29] Accepted xrdp 0.9.9-1+deb10u1 (source) into stable->embargoed, stable (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2020-07-24] Accepted xrdp 0.9.12-1.1 (source) into unstable (Salvatore Bonaccorso)
  • [2020-01-21] xrdp 0.9.12-1 MIGRATED to testing (Debian testing watch)
  • [2020-01-11] Accepted xrdp 0.9.12-1 (source) into unstable (Thorsten Glaser)
  • [2019-01-18] xrdp 0.9.9-1 MIGRATED to testing (Debian testing watch)
  • [2019-01-13] Accepted xrdp 0.9.9-1 (source amd64) into unstable (Dominik George)
  • [2018-10-02] Accepted xrdp 0.9.8-2~bpo9+1 (source) into stretch-backports (Dominik George)
  • [2018-10-02] xrdp 0.9.8-2 MIGRATED to testing (Debian testing watch)
  • [2018-09-27] Accepted xrdp 0.9.8-2 (source) into unstable (Dominik George)
  • [2018-09-26] Accepted xrdp 0.9.8-1 (source) into unstable (Dominik George)
  • [2018-08-06] xrdp REMOVED from testing (Debian testing watch)
  • [2018-07-07] Accepted xrdp 0.9.1-9+deb9u3 (source) into proposed-updates->stable-new, proposed-updates (Dominik George) (signed by: Salvatore Bonaccorso)
  • 1
  • 2
bugs [bug history graph]
  • all: 25 26
  • RC: 1
  • I&N: 21 22
  • M&W: 3
  • F&P: 0
  • patch: 4
links
  • homepage
  • lintian (9, 3)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 0.9.21.1-1
  • 71 bugs (2 patches)

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing