Skip to content
OpenAdvisories
High USN-6469-1 1 CVE

xrdp vulnerability

Published Nov 2, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Ashley Newson discovered that xrdp incorrectly handled memory when
processing certain incoming connections. An attacker could possibly use
this issue to cause a denial of service or arbitrary code execution.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS xrdp 0.9.12-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS xrdp 0.6.0-1ubuntu0.1+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS xrdp 0.6.1-2ubuntu0.3+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS xrdp 0.9.5-2ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2020-4044

    Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it

    The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman s…

    neutrinolabs xrdp xrdp xrdp Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-4044