openSUSE-SU-2019:2135-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2019:2135-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2019:2135-1
- Upstream
- Related
- Published
- 2019-09-14T16:17:10Z
- Modified
- 2026-02-04T02:47:34Z
- Summary
- Security update for rdesktop
- Details
-
This update for rdesktop fixes the following issues:
rdesktop was updated to 1.8.6:
- Fix protocol code handling new licenses
rdesktop was updated to 1.8.5:
- Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server.
rdesktop was updated to 1.8.4 (fix for boo#1121448):
- Add rdp_protocol_error function that is used in several fixes
- Refactor of process_bitmap_updates
- Fix possible integer overflow in s_check_rem() on 32bit arch
- Fix memory corruption in process_bitmap_data - CVE-2018-8794
- Fix remote code execution in process_bitmap_data - CVE-2018-8795
- Fix remote code execution in process_plane - CVE-2018-8797
- Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
- Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
- Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
- Fix Denial of Service in sec_recv - CVE-2018-20176
- Fix minor information leak in rdpdr_process - CVE-2018-8791
- Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
- Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
- Fix Denial of Service in process_bitmap_data - CVE-2018-8796
- Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
- Fix Denial of Service in process_secondary_order - CVE-2018-8799
- Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
- Fix major information leak in ui_clip_handle_data - CVE-2018-20174
- Fix memory corruption in rdp_in_unistr - CVE-2018-20177
- Fix Denial of Service in process_demand_active - CVE-2018-20178
- Fix remote code execution in lspci_process - CVE-2018-20179
- Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
- Fix remote code execution in seamless_process - CVE-2018-20181
- Fix remote code execution in seamless_process_line - CVE-2018-20182
- Fix building against OpenSSL 1.1
- remove obsolete patches
- rdesktop-Fix-OpenSSL-1.1-compability-issues.patch
- rdesktop-Fix-crash-in-rdssl_cert_to_rkey.patch
- update changes file
- add missing info about bugzilla 1121448
-
Added rdesktop-Fix-decryption.patch Patch from https://github.com/rdesktop/rdesktop/pull/334 to fix connections to VirtualBox.
-
update to 1.8.6
- Fix protocol code handling new licenses
- update to 1.8.5
- Add bounds checking to protocol handling in order to fix many security problems when communicating with a malicious server.
-
Trim redundant wording from description.
-
Use %make_install.
-
update to 1.8.4 (fix for boo#1121448)
- Add rdp_protocol_error function that is used in several fixes
- Refactor of process_bitmap_updates
- Fix possible integer overflow in s_check_rem() on 32bit arch
- Fix memory corruption in process_bitmap_data - CVE-2018-8794
- Fix remote code execution in process_bitmap_data - CVE-2018-8795
- Fix remote code execution in process_plane - CVE-2018-8797
- Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
- Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
- Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
- Fix Denial of Service in sec_recv - CVE-2018-20176
- Fix minor information leak in rdpdr_process - CVE-2018-8791
- Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
- Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
- Fix Denial of Service in process_bitmap_data - CVE-2018-8796
- Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
- Fix Denial of Service in process_secondary_order - CVE-2018-8799
- Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
- Fix major information leak in ui_clip_handle_data - CVE-2018-20174
- Fix memory corruption in rdp_in_unistr - CVE-2018-20177
- Fix Denial of Service in process_demand_active - CVE-2018-20178
- Fix remote code execution in lspci_process - CVE-2018-20179
- Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
- Fix remote code execution in seamless_process - CVE-2018-20181
- Fix remote code execution in seamless_process_line - CVE-2018-20182
- Fix building against OpenSSL 1.1
- References
-
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ/#5MCVZLNEOZHBW55VIVPPCJCYS3FNB6ZZ
- https://bugzilla.suse.com/1121448
- https://www.suse.com/security/cve/CVE-2018-20174
- https://www.suse.com/security/cve/CVE-2018-20175
- https://www.suse.com/security/cve/CVE-2018-20176
- https://www.suse.com/security/cve/CVE-2018-20177
- https://www.suse.com/security/cve/CVE-2018-20178
- https://www.suse.com/security/cve/CVE-2018-20179
- https://www.suse.com/security/cve/CVE-2018-20180
- https://www.suse.com/security/cve/CVE-2018-20181
- https://www.suse.com/security/cve/CVE-2018-20182
- https://www.suse.com/security/cve/CVE-2018-8791
- https://www.suse.com/security/cve/CVE-2018-8792
- https://www.suse.com/security/cve/CVE-2018-8793
- https://www.suse.com/security/cve/CVE-2018-8794
- https://www.suse.com/security/cve/CVE-2018-8795
- https://www.suse.com/security/cve/CVE-2018-8796
- https://www.suse.com/security/cve/CVE-2018-8797
- https://www.suse.com/security/cve/CVE-2018-8798
- https://www.suse.com/security/cve/CVE-2018-8799
- https://www.suse.com/security/cve/CVE-2018-8800
Affected packages
SUSE:Package Hub 15 SP1 / rdesktop
Package
- Name
- rdesktop
- Purl
- pkg:rpm/suse/rdesktop&distro=SUSE%20Package%20Hub%2015%20SP1