oss-sec mailing list archives
Re: CVE request: xrdp
From: "Steven M. Christey" <coley () linus mitre org>
Date: Tue, 20 Jan 2009 21:19:24 -0500 (EST)
====================================================== Name: CVE-2008-5902 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5902 Reference: MLIST:[oss-security] 20090112 CVE request: xrdp Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3 Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf Buffer overflow in the xrdp_bitmap_invalidate function in xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via a crafted request. ====================================================== Name: CVE-2008-5903 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5903 Reference: MLIST:[oss-security] 20090112 CVE request: xrdp Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3 Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_pos structure member. ====================================================== Name: CVE-2008-5904 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5904 Reference: MLIST:[oss-security] 20090112 CVE request: xrdp Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3 Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impact via input data that sets crafted values for certain length variables, leading to a buffer overflow.
Current thread:
- CVE request: xrdp Thomas Biege (Jan 12)
- Re: CVE request: xrdp Steven M. Christey (Jan 20)