{"id":"CVE-2023-42822","aliases":["ALPINE-CVE-2023-42822","DEBIAN-CVE-2023-42822","DLA-4166-1","EUVD-2023-47243","GHSA-2hjx-rm4f-r9hw","MGASA-2023-0334","SUSE-SU-2023:4577-1","SUSE-SU-2023:4873-1","UBUNTU-CVE-2023-42822","USN-6474-1","USN-8476-1","openSUSE-SU-2024:13399-1"],"status":"published","title":"Unchecked access to font glyph info in xrdp","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00738,"percentile":0.54823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-09-27T17:55:02Z","modified":"2026-11-03T06:32:43Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xrdp","fixed_in":["0.9.23.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xrdp","fixed_in":["0.9.21.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xrdp","fixed_in":["0.9.24-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xrdp","fixed_in":["0.9.24-2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xrdp","fixed_in":["0.9.23.1-1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xrdp","fixed_in":["0.9.13.1-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xrdp","fixed_in":["0.9.13.1-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xrdp","fixed_in":["0.9.13.1-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xrdp","fixed_in":["0.9.13.1-150200.4.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xrdp","fixed_in":["0.6.0-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xrdp","fixed_in":["0.6.1-2ubuntu0.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","fixed_in":["0.9.5-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","fixed_in":["0.9.12-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","fixed_in":["0.9.17-2ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","fixed_in":["0.9.24-4ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1+deb12u1"}]}],"versions":["0.9.21.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1~deb11u2"}]}],"versions":["0.9.12-1.1","0.9.15-1","0.9.17-1","0.9.17-2","0.9.17-2.1","0.9.19-1","0.9.21.1-1~deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1ubuntu0.1+esm3"}]}],"versions":["0.6.0-1","0.6.0-1ubuntu0.1","0.6.0-1ubuntu0.1+esm1","0.6.0-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.3+esm3"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.1","0.6.1-2ubuntu0.3","0.6.1-2ubuntu0.3+esm1","0.6.1-2ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm2"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu2+esm1"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1ubuntu0.1+esm3"}]}],"versions":["0.6.0-1","0.6.0-1ubuntu0.1","0.6.0-1ubuntu0.1+esm1","0.6.0-1ubuntu0.1+esm2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2ubuntu0.3+esm3"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.1","0.6.1-2ubuntu0.3","0.6.1-2ubuntu0.3+esm1","0.6.1-2ubuntu0.3+esm2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm2"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm1"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu2+esm1"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm3"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm2"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu3+esm2"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1build0.25.10.1"}]}],"versions":["0.10.1-3","0.10.1-3.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"neutrinolabs","product":"xrdp"}],"references":[{"url":"https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFGL22QQF65OIZRMCKUZCVJQCKGUBRYE/","tags":["x_transferred","Mailing List","Release Notes","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTXODUR4ILM7ZPA6ZGY6VSK4BBSBMKGY/","tags":["x_transferred","Mailing List","Release Notes","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FPGA4M7IYCP7OILDF2ZJEVSXUOFEFQ6/","tags":["x_transferred","Release Notes","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00018.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-42822","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42822.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42822","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-42822","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32575","tags":["report"]},{"url":"https://lwn.net/Articles/952920/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215803","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42822","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214805","tags":["report"]},{"url":"https://bugzilla.suse.com/1217759","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40184","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-42822","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6474-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42822","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68670","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-42822","title":"Unchecked access to font glyph info in xrdp","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T17:55:02.416Z","modified":"2025-11-03T19:28:19.81Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:17.812395Z"}],"euvd":[{"id":"EUVD-2023-47243","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T17:55:02Z","modified":"2025-11-03T19:28:19Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:34.152725Z"}],"nvd":[{"id":"CVE-2023-42822","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T18:15:11.903Z","modified":"2026-06-17T06:24:35.717Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"ALPINE-CVE-2023-42822","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T18:15:11.903Z","modified":"2026-11-03T06:32:43.411550864Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-42822","title":"Unchecked access to font glyph info in xrdp","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T17:55:02.416Z","modified":"2026-10-28T02:31:01.833698168Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-42822","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T18:15:11.903Z","modified":"2026-10-26T18:03:06.954782321Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-42822","description":"xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-09-27T18:15:00Z","modified":"2026-06-25T23:59:16.846962166Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"DLA-4166-1","title":"xrdp - security update","status":"published","published":"2025-05-16T00:00:00Z","modified":"2026-03-09T01:19:58.050706Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2023-0334","title":"Updated xrdp packages fix security vulnerability","description":"The updated packages fix a security vulnerability\n\nAccess to the font glyphs in xrdp_painter.c is not bounds-checked. Since\nsome of this data is controllable by the user, this can result in an\nout-of-bounds read within the xrdp executable. The vulnerability allows\nan out-of-bounds read within a potentially privileged process. On\nnon-Debian platforms, xrdp tends to run as root. Potentially an\nout-of-bounds write can follow the out-of-bounds read. There is no\ndenial-of-service impact, providing xrdp is running in forking mode.\n(CVE-2023-42822)\n","status":"published","published":"2023-12-01T11:54:47Z","modified":"2026-04-16T04:40:37.564493285Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13399-1","title":"libpainter0-0.9.23.1-1.1 on GA media","description":"These are all security issues fixed in the libpainter0-0.9.23.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:25.770425Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4577-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2023-42822: Fixed unchecked access to font glyph info (bsc#1215803).\n","status":"published","published":"2023-11-27T08:30:16Z","modified":"2026-02-04T04:40:24.606926Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4873-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2023-42822: Fixed unchecked access to font glyph info (bsc#1215803).\n- CVE-2023-40184: Fixed restriction bypass via improper session handling (bsc#1214805).\n","status":"published","published":"2023-12-14T18:52:09Z","modified":"2026-02-04T03:34:05.949314Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6474-1","title":"xrdp vulnerabilities","description":"It was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. (CVE-2022-23479, CVE-2022-23481, CVE-2022-23483,\nCVE-2023-42822)\n\nIt was discovered that xrdp improperly handled session establishment\nerrors. An attacker could potentially use this issue to bypass the\nOS-level session restrictions by PAM. (CVE-2023-40184)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23468)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-23480, CVE-2022-23482, CVE-2022-23484)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23477, CVE-2022-23493)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds writes. An attacker\ncould possibly use this issue to cause memory corruption or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-23478)\n\nIt was discovered that xrdp incorrectly handled validation of\nclient-supplied data, which could lead to out-of-bounds reads. An attacker\ncould possibly use this issue to crash the program or extract sensitive\ninformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-23613)\n","status":"published","published":"2023-11-08T13:47:00Z","modified":"2026-06-29T13:50:59.884369844Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-8476-1","title":"xrdp vulnerabilities","description":"It was discovered that xrdp incorrectly handled bounds checking when\nprocessing user domain information during the connection sequence. An\nunauthenticated remote attacker could use this issue to cause xrdp to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-68670)\n\nIt was discovered that xrdp did not correctly enforce the maximum number of\nlogin attempts configured by the MaxLoginRetry parameter. A remote attacker\ncould use this issue to perform an unlimited number of login attempts.\n(CVE-2024-39917)\n\nIt was discovered that xrdp did not perform bounds checking when accessing\nfont glyphs. Since some of this data is controllable by the user, a remote\nattacker could use this issue to cause xrdp to read out of bounds. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)\n\nIt was discovered that xrdp did not properly handle session establishment\nerrors. A remote attacker could use this issue to bypass OS-level session\nrestrictions enforced by PAM, such as the maximum number of concurrent\nsessions per user. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2023-40184)","status":"published","published":"2026-06-25T14:47:42Z","modified":"2026-06-25T23:59:17.105152448Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}