Arch Linux Security Advisory ASA-201902-5 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794 CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798 CVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175 CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182 Package : rdesktop Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-871 Summary ======= The package rdesktop before version 1.8.4-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "rdesktop>=1.8.4-1" The problems have been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== - CVE-2018-8791 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpdr_process() that results in an information leak. - CVE-2018-8792 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function cssp_read_tsrequest() that results in a denial of service (segfault). - CVE-2018-8793 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8794 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to an out-of-bounds write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution. - CVE-2018-8795 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to a heap-based buffer overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution. - CVE-2018-8796 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_bitmap_updates() that results in a denial of service (segfault). - CVE-2018-8797 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function process_plane() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8798 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpsnd_process_ping() that results in an information leak. - CVE-2018-8799 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_secondary_order() that results in a denial of service (segfault). - CVE-2018-8800 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution. - CVE-2018-20174 (information disclosure) rdesktop before 1.8.4 is vulnerable to an information leak in ui_clip_handle_data(). - CVE-2018-20175 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in mcs_recv_connect_response() and mcs_parse_domain_params(). - CVE-2018-20176 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in sec_parse_crypt_info() and sec_recv(). - CVE-2018-20177 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a memory corruption issue in rdp_in_unistr() that could lead to arbitrary code execution. - CVE-2018-20178 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in process_demand_active(). - CVE-2018-20179 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in lspci_process(). - CVE-2018-20180 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in rdpsnddbg_process(). - CVE-2018-20181 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process(). - CVE-2018-20182 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process_line(). Impact ====== A remote attacker is able to execute arbitrary code, access sensitive information or crash rdesktop when the client connects to a malicious server in control of the attacker. References ========== https://bugs.archlinux.org/task/61652 https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85... https://security.archlinux.org/CVE-2018-8791 https://security.archlinux.org/CVE-2018-8792 https://security.archlinux.org/CVE-2018-8793 https://security.archlinux.org/CVE-2018-8794 https://security.archlinux.org/CVE-2018-8795 https://security.archlinux.org/CVE-2018-8796 https://security.archlinux.org/CVE-2018-8797 https://security.archlinux.org/CVE-2018-8798 https://security.archlinux.org/CVE-2018-8799 https://security.archlinux.org/CVE-2018-8800 https://security.archlinux.org/CVE-2018-20174 https://security.archlinux.org/CVE-2018-20175 https://security.archlinux.org/CVE-2018-20176 https://security.archlinux.org/CVE-2018-20177 https://security.archlinux.org/CVE-2018-20178 https://security.archlinux.org/CVE-2018-20179 https://security.archlinux.org/CVE-2018-20180 https://security.archlinux.org/CVE-2018-20181 https://security.archlinux.org/CVE-2018-20182