Skip to content
OpenAdvisories
Unscored USN-4815-1 2 CVEs

xrdp vulnerabilities

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that xrdp did not properly validate certain input in the
session manager. A local attacker could possibly use this issue to cause a
denial of service or other unspecified impact. (CVE-2017-16927)

It was discovered that xrdp did not properly initialize PAM session
modules. A remote attacker could possibly use this issue to escalate
privileges. (CVE-2017-6967)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS xrdp 0.6.0-1ubuntu0.1+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS xrdp 0.6.1-2ubuntu0.3+esm1

Vulnerabilities 2

  • Unscored —
    CVE-2017-16927

    The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted…

    xrdp xrdp Debian Ubuntu
  • Unscored —
    CVE-2017-6967

    xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not bei…

    xrdp xrdp Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-6967
  • report
    https://ubuntu.com/security/CVE-2017-16927