CVE-2008-1803
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote...
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
Exploit likelihood
What each source reports
NVD Score used
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- Updated
- 2026-11-02
EUVDEUVD-2008-1803No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
EUVD-2008-1803- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6mv-mc2j-c734No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote...
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
GHSA-h6mv-mc2j-c734- Updated
- 2026-11-02
OSVNo score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
CVE-2008-1803- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1803No score
Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.
- Record
DEBIAN-CVE-2008-1803- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11298-1No score
rdesktop-1.9.0-4.6 on GA media
These are all security issues fixed in the rdesktop-1.9.0-4.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11298-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rdesktopDebian:12 | before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:13 | before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:14 | before 1.5.0-4+cvs20071006 | 1.5.0-4+cvs20071006 |
rdesktopDebian:4.0 From an advisory covering 3 CVEs | before 1.5.0-1etch2, plus listed versions 1.5.0-11.5.0-1etch1 | 1.5.0-1etch2 |
rdesktopRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktop-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktopRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktop-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.4.1-6 | 0:1.4.1-6 |
rdesktopopenSUSE:Tumbleweed From an advisory covering 22 CVEs | before 1.9.0-4.6 | 1.9.0-4.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1803 is a high vulnerability (CVSS 9.3) in Rdesktop, published May 11, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.74%, the 94th percentile. Fixed in rdesktop 1.5.0-4+cvs20071006.
References
secunia.com/advisories/31224
exchange.xforce.ibmcloud.com/vulnerabilities/42277
ubuntu.com/usn/usn-646-1
security.gentoo.org/glsa/glsa-200806-04.xml
redhat.com/archives/fedora-package-announce/2008-May/msg00270.html
Show 53 moreShow less
debian.org/security/2008/dsa-1573
securitytracker.com/id?1019992
labs.idefense.com/intelligence/vulnerabilities/display.php?id=698
vupen.com/english/advisories/2008/2403
rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdesktop.c?r1=1.161&r2=1.162&pathrev=HEAD
securityfocus.com/bid/29097
sunsolve.sun.com/search/document.do?assetkey=1-26-240708-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9800
mandriva.com/security/advisories?name=MDVSA-2008:101
sourceforge.net/mailarchive/message.php?msg_name=20080511065217.GA24455%40cse.unsw.EDU.AU
support.avaya.com/elmodocs2/security/ASA-2008-360.htm
nvd.nist.gov/vuln/detail/CVE-2008-1803
github.com/advisories/GHSA-h6mv-mc2j-c734
security-tracker.debian.org/tracker/CVE-2008-1803
access.redhat.com/errata/RHSA-2008:0575
bugzilla.redhat.com/show_bug.cgi?id=445825
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0575.json
cve.org/CVERecord?id=CVE-2008-1801
suse.com/security/cve/CVE-2008-1801