ArchLinux: 201902-5: rdesktop: multiple issues
Summary
- CVE-2018-8791 (information disclosure)
rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function rdpdr_process() that results in an information leak.
- CVE-2018-8792 (denial of service)
rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function cssp_read_tsrequest() that results in a denial of service
(segfault).
- CVE-2018-8793 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function cssp_read_tsrequest() that results in a memory corruption and
probably even a remote code execution.
- CVE-2018-8794 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to an integer overflow that leads
to an out-of-bounds write in function process_bitmap_updates() and
results in a memory corruption and possibly even a remote code
execution.
- CVE-2018-8795 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to an integer overflow that leads
to a heap-based buffer overflow in function process_bitmap_updates()
and results in a memory corruption and probably even a remote code
execution.
- CVE-2018-8796 (denial of service)
rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function process_bitmap_updates() that results in a denial of service
(segfault).
- CVE-2018-8797 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function process_plane() that results in a memory corruption and
probably even a remote code execution.
- CVE-2018-8798 (information disclosure)
rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function rdpsnd_process_ping() that results in an information leak.
- CVE-2018-8799 (denial of service)
rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in
function process_secondary_order() that results in a denial of service
(segfault).
- CVE-2018-8800 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in
function ui_clip_handle_data() that results in a memory corruption and
probably even a remote code execution.
- CVE-2018-20174 (information disclosure)
rdesktop before 1.8.4 is vulnerable to an information leak in
ui_clip_handle_data().
- CVE-2018-20175 (denial of service)
rdesktop before 1.8.4 is vulnerable to denial of service in
mcs_recv_connect_response() and mcs_parse_domain_params().
- CVE-2018-20176 (denial of service)
rdesktop before 1.8.4 is vulnerable to denial of service in
sec_parse_crypt_info() and sec_recv().
- CVE-2018-20177 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to a memory corruption issue in
rdp_in_unistr() that could lead to arbitrary code execution.
- CVE-2018-20178 (denial of service)
rdesktop before 1.8.4 is vulnerable to denial of service in
process_demand_active().
- CVE-2018-20179 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to remote code execution in
lspci_process().
- CVE-2018-20180 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to remote code execution in
rdpsnddbg_process().
- CVE-2018-20181 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to remote code execution in
seamless_process().
- CVE-2018-20182 (arbitrary code execution)
rdesktop before 1.8.4 is vulnerable to remote code execution in
seamless_process_line().
Resolution
Upgrade to 1.8.4-1.
# pacman -Syu "rdesktop>=1.8.4-1"
The problems have been fixed upstream in version 1.8.4.
References
https://bugs.archlinux.org/task/61652 https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1 https://security.archlinux.org/CVE-2018-8791 https://security.archlinux.org/CVE-2018-8792 https://security.archlinux.org/CVE-2018-8793 https://security.archlinux.org/CVE-2018-8794 https://security.archlinux.org/CVE-2018-8795 https://security.archlinux.org/CVE-2018-8796 https://security.archlinux.org/CVE-2018-8797 https://security.archlinux.org/CVE-2018-8798 https://security.archlinux.org/CVE-2018-8799 https://security.archlinux.org/CVE-2018-8800 https://security.archlinux.org/CVE-2018-20174 https://security.archlinux.org/CVE-2018-20175 https://security.archlinux.org/CVE-2018-20176 https://security.archlinux.org/CVE-2018-20177 https://security.archlinux.org/CVE-2018-20178 https://security.archlinux.org/CVE-2018-20179 https://security.archlinux.org/CVE-2018-20180 https://security.archlinux.org/CVE-2018-20181 https://security.archlinux.org/CVE-2018-20182
Workaround
None.
