Summary
It was discovered that xrdp incorrectly handled bounds checking when
processing user domain information during the connection sequence. An
unauthenticated remote attacker could use this issue to cause xrdp to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-68670)
It was discovered that xrdp did not correctly enforce the maximum number of
login attempts configured by the MaxLoginRetry parameter. A remote attacker
could use this issue to perform an unlimited number of login attempts.
(CVE-2024-39917)
It was discovered that xrdp did not perform bounds checking when accessing
font glyphs. Since some of this data is controllable by the user, a remote
attacker could use this issue to cause xrdp to read out of bounds. This
issue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)
It was discovered that xrdp did not properly handle session establishment
errors. A remote attacker could use this issue to bypass OS-level session
restrictions enforced by PAM, such as the maximum number of concurrent
sessions per user. This issue only affected Ubuntu 24.04 LTS.
(CVE-2023-40184)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | xrdp | 0.10.1-3.1+deb13u1build0.25.10.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | xrdp | 0.9.5-2ubuntu0.1~esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | xrdp | 0.9.12-1ubuntu0.1+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | xrdp | 0.9.17-2ubuntu3+esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | xrdp | 0.9.24-4ubuntu0.1~esm1 |
Vulnerabilities 4
-
Critical 9.1
xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, t…
-
High 7.2
xrdp allows an ininite number of login attempts
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` i…
-
Medium 4.6
Unchecked access to font glyph info in xrdp
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerabil…
-
Low 2.6
Improper handling of session establishment errors in xrdp
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g.…