CVE-2023-40184

xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The auth_start_session function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.

In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The auth_start_session function can return non-zero (1) value on, e.g., PAM error which may result in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. (CVE-2023-40184)

These are all security issues fixed in the libpainter0-0.9.23.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for xrdp fixes the following issues:

• CVE-2023-40184: Fixed restriction bypass via improper session handling (bsc#1214805).

This update for xrdp fixes the following issues:

• CVE-2023-40184: Fixed restriction bypass via improper session handling (bsc#1214805).

This update for xrdp fixes the following issues:

• CVE-2023-42822: Fixed unchecked access to font glyph info (bsc#1215803).
• CVE-2023-40184: Fixed restriction bypass via improper session handling (bsc#1214805).

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive information. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483, CVE-2023-42822)

It was discovered that xrdp improperly handled session establishment errors. An attacker could potentially use this issue to bypass the OS-level session restrictions by PAM. (CVE-2023-40184)

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds writes. An attacker could possibly use this issue to cause memory corruption or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23478)

It was discovered that xrdp incorrectly handled validation of client-supplied data, which could lead to out-of-bounds reads. An attacker could possibly use this issue to crash the program or extract sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)

It was discovered that xrdp incorrectly handled bounds checking when processing user domain information during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-68670)

It was discovered that xrdp did not correctly enforce the maximum number of login attempts configured by the MaxLoginRetry parameter. A remote attacker could use this issue to perform an unlimited number of login attempts. (CVE-2024-39917)

It was discovered that xrdp did not perform bounds checking when accessing font glyphs. Since some of this data is controllable by the user, a remote attacker could use this issue to cause xrdp to read out of bounds. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)

It was discovered that xrdp did not properly handle session establishment errors. A remote attacker could use this issue to bypass OS-level session restrictions enforced by PAM, such as the maximum number of concurrent sessions per user. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-40184)