{"id":"CVE-2022-23482","aliases":["ALPINE-CVE-2022-23482","DEBIAN-CVE-2022-23482","DLA-3375-1","DSA-5502-1","EUVD-2022-28543","GHSA-56pq-2pm9-7fhm","MGASA-2023-0002","SUSE-SU-2023:0012-1","SUSE-SU-2023:0033-1","SUSE-SU-2023:0340-1","SUSE-SU-2023:0374-1","SUSE-SU-2023:0387-1","UBUNTU-CVE-2022-23482","USN-6474-1","openSUSE-SU-2024:12602-1"],"status":"published","title":"Out-of-Bound Read in xrdp","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00797,"percentile":0.56771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-12-09T17:50:39Z","modified":"2026-11-03T08:00:40Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xrdp","fixed_in":["0.9.21.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xrdp","fixed_in":["0.9.21.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xrdp","fixed_in":["0.9.21.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xrdp","fixed_in":["0.9.21.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","fixed_in":["0.9.5-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","fixed_in":["0.9.12-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","fixed_in":["0.9.17-2ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9-1+deb10u3"}]}],"versions":["0.9.9-1","0.9.9-1+deb10u1","0.9.9-1+deb10u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1~deb11u1"}]}],"versions":["0.9.12-1.1","0.9.15-1","0.9.17-1","0.9.17-2","0.9.17-2.1","0.9.19-1"],"bundled":10},{"source":"osv","ecosystem":"Mageia:8","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21-1.mga8"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150000.4.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150000.4.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150000.4.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-150000.4.11.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0~git.1456906198.f422461-21.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0~git.1456906198.f422461-21.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0~git.1456906198.f422461-21.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0~git.1456906198.f422461-21.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0~git.1456906198.f422461-16.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm2"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu2+esm1"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1ubuntu0.1+esm3"}]}],"versions":["0.6.0-1","0.6.0-1ubuntu0.1","0.6.0-1ubuntu0.1+esm1","0.6.0-1ubuntu0.1+esm2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.3+esm3"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.1","0.6.1-2ubuntu0.3","0.6.1-2ubuntu0.3+esm1","0.6.1-2ubuntu0.3+esm2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm2"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu2+esm1"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.20-4.1"}]}],"bundled":10}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"neutrinolabs","product":"xrdp"}],"references":[{"url":"https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-56pq-2pm9-7fhm","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2023/dsa-5502","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-23482","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23482.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23482","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23482","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0002.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31309","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/67CHZVOMSTH2Q7P3TYFUNZUA6J7ZYEBQ/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230012-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206300","tags":["report"]},{"url":"https://bugzilla.suse.com/1206303","tags":["report"]},{"url":"https://bugzilla.suse.com/1206306","tags":["report"]},{"url":"https://bugzilla.suse.com/1206307","tags":["report"]},{"url":"https://bugzilla.suse.com/1206310","tags":["report"]},{"url":"https://bugzilla.suse.com/1206311","tags":["report"]},{"url":"https://bugzilla.suse.com/1206312","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23484","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230033-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206302","tags":["report"]},{"url":"https://bugzilla.suse.com/1206313","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23493","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230340-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230374-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206621","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230387-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23482","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6474-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42822","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23477","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-23482","title":"Out-of-Bound Read in xrdp","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T17:50:39.075Z","modified":"2025-04-23T16:29:43.35Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-28543","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T17:50:39Z","modified":"2025-04-23T16:29:43Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"updated_at":"2026-11-02T20:52:12.74685Z"}],"nvd":[{"id":"CVE-2022-23482","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T18:15:16.557Z","modified":"2026-06-17T04:30:12.77Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"ALPINE-CVE-2022-23482","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T18:15:16.557Z","modified":"2026-11-03T07:30:19.214072483Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-23482","title":"Out-of-Bound Read in xrdp","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).\nxrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T17:50:39.075Z","modified":"2026-10-28T02:30:28.32566025Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-23482","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T18:15:16.557Z","modified":"2026-11-03T08:00:40.084613294Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"UBUNTU-CVE-2022-23482","description":"xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp \u003c v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.","status":"published","published":"2022-12-09T18:15:00Z","modified":"2026-02-04T03:03:57.06588Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3375-1","title":"xrdp - security update","status":"published","published":"2023-03-31T00:00:00Z","modified":"2026-03-09T01:22:40.932132Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5502-1","title":"xrdp - security update","status":"published","published":"2023-09-18T00:00:00Z","modified":"2026-03-09T02:10:07.078715Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0002","title":"Updated xrdp packages fix security vulnerability","description":"xrdp less than v0.9.21 contain a buffer over flow in\nxrdp_login_wnd_create() function. (CVE-2022-23468)\n\nxrdp less than v0.9.21 contain a buffer over flow in audin_send_open()\nfunction. (CVE-2022-23477)\n\nxrdp less than v0.9.21 contain a Out of Bound Write in\nxrdp_mm_trans_process_drdynvc_channel_open() function. (CVE-2022-23478)\n\nxrdp less than v0.9.21 contain a buffer over flow in\nxrdp_mm_chan_data_in() function. (CVE-2022-23479)\n\nxrdp less than v0.9.21 contain a buffer over flow in\ndevredir_proc_client_devlist_announce_req() function. (CVE-2022-23480)\n\nxrdp less than v0.9.21 contain a Out of Bound Read in\nxrdp_caps_process_confirm_active() function. (CVE-2022-23481)\n\nxrdp less than v0.9.21 contain a Out of Bound Read in\nxrdp_sec_process_mcs_data_CS_CORE() function. (CVE-2022-23482)\n\nxrdp less than v0.9.21 contain a Out of Bound Read in\nlibxrdp_send_to_channel() function. (CVE-2022-23483)\n\nxrdp less than v0.9.21 contain a Integer Overflow in\nxrdp_mm_process_rail_update_window_text() function. (CVE-2022-23484)\n\nxrdp less than v0.9.21 contain a Out of Bound Read in\nxrdp_mm_trans_process_drdynvc_channel_close() function. (CVE-2022-23493)\n","status":"published","published":"2023-01-13T17:37:09Z","modified":"2026-04-16T04:44:18.201386217Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12602-1","title":"libpainter0-0.9.20-4.1 on GA media","description":"These are all security issues fixed in the libpainter0-0.9.20-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:38.288252Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0012-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).\n- CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).\n- CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).\n- CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).\n- CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310).\n- CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).\n- CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).\n","status":"published","published":"2023-01-02T10:46:01Z","modified":"2026-02-04T04:19:18.152923Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0033-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).\n- CVE-2022-23478: Fixed an out of bound write in xrdp_mm_trans_process_drdynvc_chan() (bsc#1206302).\n- CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).\n- CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).\n- CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).\n- CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310).\n- CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).\n- CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).\n- CVE-2022-23493: Fixed an out of bound read in xrdp_mm_trans_process_drdynvc_channel_close() (bsc#1206313).\n","status":"published","published":"2023-01-05T14:09:56Z","modified":"2026-02-04T03:16:06.401284Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0340-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).\n- CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).\n- CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).\n- CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).\n- CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310).\n- CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).\n- CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).\n","status":"published","published":"2023-02-10T08:39:29Z","modified":"2026-02-04T04:00:58.475936Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0374-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).\n- CVE-2022-23478: Fixed an out of bound write in xrdp_mm_trans_process_drdynvc_chan() (bsc#1206302).\n- CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).\n- CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).\n- CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).\n- CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310, bsc#1206621).\n- CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).\n- CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).\n- CVE-2022-23493: Fixed an out of bound read in xrdp_mm_trans_process_drdynvc_channel_close() (bsc#1206313).\n","status":"published","published":"2023-02-10T15:32:11Z","modified":"2026-02-04T03:54:20.849609Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0387-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).\n- CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).\n- CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).\n- CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).\n- CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310).\n- CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).\n- CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).\n","status":"published","published":"2023-02-13T07:20:16Z","modified":"2026-02-04T04:22:52.641421Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-6474-1","title":"xrdp vulnerabilities","description":"It was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,\nCVE-2023-42822)\n\nIt was discovered that xrdp improperly handled session establishment\nerrors. An attacker could potentially use this issue to bypass the\nOS-level session restrictions by PAM. (CVE-2023-40184)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23478)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)\n","status":"published","published":"2023-11-08T13:47:00Z","modified":"2026-06-29T13:50:59.884369844Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}