Branch c8 update bulletin.

Package rpm-build-altlinux-compat updated to version 2.1.8-alt0.M80P.1 for branch c8 in task 238352.

переопределяет %_localstatedir

Package xrdp updated to version 0.9.10-alt1 for branch c8 in task 238352.

Published: 2016-12-16
Modified: 2024-11-21

CVE-2013-1430

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2017-11-23
Modified: 2024-11-21

CVE-2017-16927

The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

Severity: HIGH (8.4) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

update XRDP 0.9.2 --> 0.9.3

Version: 2.1.0

Branch c8 update on 2019-11-13

ALT-BU-2019-4062-1

ALT-PU-2019-3081-1

Closed bugs

Bug #32554

ALT-PU-2019-3082-1

Closed vulnerabilities

CVE-2013-1430

CVE-2017-16927

Closed bugs

Bug #33674