MGASA-2026-0566

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0566.html
Import Source
https://advisories.mageia.org/MGASA-2026-0566.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0566
Upstream
CVE (10)
Published
2026-10-30T01:10:00Z
Modified
2026-10-30T01:28:13Z
Summary
Updated xrdp package fixes security vulnerabilities
Details

lib_palette_update Heap Buffer Overflow & RCE. (CVE-2026-41252) lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass. (CVE-2026-41521) Channel Data Forwarding Fixed-Size Buffer Overflow. (CVE-2026-44178) XRDP is vulnerable to a server timing attack, leading to user enumeration. (CVE-2026-42218) Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification. (CVE-2026-44978) Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER. (CVE-2026-54538) Malformed Confirm Active capability sets cause out-of-bounds reads. (CVE-2026-55238) No authentication required with Xvnc backend. (CVE-2026-55626) Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY). (CVE-2026-55639) Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control). (CVE-2026-55645)

References
Credits

Affected packages

Mageia:10 / xrdp

Package

Name
xrdp
Purl
pkg:rpm/mageia/xrdp?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.10.6.1-2.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0566.json"