xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6474-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

  - xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow     leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to     locally access a sesman server to execute code as root. This vulnerability has been patched in version     0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds. (CVE-2022-23613)

  - xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling     of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session`     function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions     such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users     (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release     version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
    (CVE-2023-40184)

  - xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not     bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds     read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially     privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write     can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in     forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are     no known workarounds for this vulnerability. (CVE-2023-42822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5502 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3375 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0387-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0340-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0374-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0033-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0012-1 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-08d2138578 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ba94433c-7890-11ed-859e-1c61b4739ac9 advisory.

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23468)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are     no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23477)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in     xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23478)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23479)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in     devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23480)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23481)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE()     function. There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23482)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function.
    There are no known workarounds for this issue. Users are advised to upgrade. (CVE-2022-23483)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in     xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users     are advised to upgrade. (CVE-2022-23484)

  - xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote     Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in     xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue.
    Users are advised to upgrade. (CVE-2022-23493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185416	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xrdp vulnerabilities (USN-6474-1)	Nessus	Ubuntu Local Security Checks	critical
181564	Debian DSA-5502-1 : xrdp - security update	Nessus	Debian Local Security Checks	critical
173742	Debian DLA-3375-1 : xrdp - LTS security update	Nessus	Debian Local Security Checks	critical
171494	SUSE SLES12 Security Update : xrdp (SUSE-SU-2023:0387-1)	Nessus	SuSE Local Security Checks	critical
171423	SUSE SLES12 Security Update : xrdp (SUSE-SU-2023:0340-1)	Nessus	SuSE Local Security Checks	critical
171404	SUSE SLES12 Security Update : xrdp (SUSE-SU-2023:0374-1)	Nessus	SuSE Local Security Checks	critical
169636	SUSE SLED15 / SLES15 Security Update : xrdp (SUSE-SU-2023:0033-1)	Nessus	SuSE Local Security Checks	critical
169470	SUSE SLES15 Security Update : xrdp (SUSE-SU-2023:0012-1)	Nessus	SuSE Local Security Checks	critical
169266	Fedora 36 : 1:xrdp (2022-08d2138578)	Nessus	Fedora Local Security Checks	critical
168620	FreeBSD : xrdp -- multiple vulnerabilities (ba94433c-7890-11ed-859e-1c61b4739ac9)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2022-23482

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical