[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0901202119040.22454@faron.mitre.org>
Date: Tue, 20 Jan 2009 21:19:24 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: xrdp
======================================================
Name: CVE-2008-5902
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5902
Reference: MLIST:[oss-security] 20090112 CVE request: xrdp
Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3
Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf
Buffer overflow in the xrdp_bitmap_invalidate function in
xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers
to execute arbitrary code via a crafted request.
======================================================
Name: CVE-2008-5903
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5903
Reference: MLIST:[oss-security] 20090112 CVE request: xrdp
Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3
Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf
Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c
in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary
code via vectors that manipulate the value of the edit_pos structure
member.
======================================================
Name: CVE-2008-5904
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5904
Reference: MLIST:[oss-security] 20090112 CVE request: xrdp
Reference: URL:http://openwall.com/lists/oss-security/2009/01/12/3
Reference: MISC:http://packetstormsecurity.org/0812-advisories/VA_VD_87_08_XRDP.pdf
The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in
xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown
impact via input data that sets crafted values for certain length
variables, leading to a buffer overflow.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
