CVE-2008-1803
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote...
CVE-2008-1803 is a high vulnerability (CVSS 9.3) in Rdesktop, published May 11, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.74%, the 93rd percentile. Fixed in rdesktop 1.5.0-4+cvs20071006.
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
Exploit likelihood
What each source reports
NVD Score used
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- Updated
- 2026-11-02
EUVDEUVD-2008-1803 No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
EUVD-2008-1803- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6mv-mc2j-c734 No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote...
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
GHSA-h6mv-mc2j-c734- Updated
- 2026-11-02
OSV No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1803 No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
DEBIAN-CVE-2008-1803- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11298-1 No score
rdesktop-1.9.0-4.6 on GA media
These are all security issues fixed in the rdesktop-1.9.0-4.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11298-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rdesktopDebian:12 |
before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:13 |
before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:14 |
before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:4.0 |
before 1.5.0-1etch2, plus listed versions 1.5.0-11.5.0-1etch1 |
1.5.0-1etch2 |
rdesktopRed Hat:enterprise_linux:5::client |
before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktop-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktopRed Hat:enterprise_linux:5::server |
before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktop-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktopopenSUSE:Tumbleweed |
before 1.9.0-4.6 | 1.9.0-4.6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/31224
exchange.xforce.ibmcloud.com/vulnerabilities/42277
ubuntu.com/usn/usn-646-1
security.gentoo.org/glsa/glsa-200806-04.xml
redhat.com/archives/fedora-package-announce/2008-May/msg00270.html
Show 53 moreShow less
debian.org/security/2008/dsa-1573
securitytracker.com/id?1019992
labs.idefense.com/intelligence/vulnerabilities/display.php?id=698
vupen.com/english/advisories/2008/2403
rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdesktop.c?r1=1.161&r2=1.162&pathrev=HEAD
securityfocus.com/bid/29097
sunsolve.sun.com/search/document.do?assetkey=1-26-240708-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9800
mandriva.com/security/advisories?name=MDVSA-2008:101
sourceforge.net/mailarchive/message.php?msg_name=20080511065217.GA24455%40cse.unsw.EDU.AU
support.avaya.com/elmodocs2/security/ASA-2008-360.htm
nvd.nist.gov/vuln/detail/CVE-2008-1803
github.com/advisories/GHSA-h6mv-mc2j-c734
security-tracker.debian.org/tracker/CVE-2008-1803
access.redhat.com/errata/RHSA-2008:0575
bugzilla.redhat.com/show_bug.cgi?id=445825
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0575.json
cve.org/CVERecord?id=CVE-2008-1801
suse.com/security/cve/CVE-2008-1801