-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4737-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 29, 2020 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : xrdp CVE ID : CVE-2020-4044 Debian Bug : 964573 Ashley Newson discovered that the XRDP sessions manager was susceptible to denial of service. A local attacker can further take advantage of this flaw to impersonate the XRDP sessions manager and capture any user credentials that are submitted to XRDP, approve or reject arbitrary login credentials or to hijack existing sessions for xorgxrdp sessions. For the stable distribution (buster), this problem has been fixed in version 0.9.9-1+deb10u1. We recommend that you upgrade your xrdp packages. For the detailed security status of xrdp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xrdp Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl8h2zJfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Qerw//XxRIJXHiGQ6cOSlKAvcVxWHOxueoLEyePlyh01mbtpvp8P10foOhRsgI wxGODoVjZXU8+Thatj6opcabQisFG1qaf9VO7q2MmJoTU+bDDefkYp3kZIodUTWa 7fH6mu6fb5nVNVjKC1k9uaCf2mm8s+aq8eFst4eSSo/cmFdYXlMk5r+2XOwKdbBw nvpjqkwxzTRyQu1z4gjyeypJMfNuhdsZ9r1NS5IRlxQazLG6QogkZ2k8BvXqeUR1 JO6K/d3GZGxtPJZuf7RZerExzVFfsoNetZ8ViQqq6LSCcDlgRVNzQf2svf3qj2pV FHgY0I0QXiY6z87SNd4wVr/zGID8n3IwekoLqDXPohlZiGfBUH9aK5jI7B+ysd66 igDqlNe++ojbWyYAF3oRkEom9BWauAQqcqw4m7jpuuDsOWvwcBIYGQn5VRDcmo1W 1ckoczmK6UYM5PShJGPC7a2fdcMJ3VXAzolzxYTlA6swcNVWlt9rXvzKZMGL5UWW P+cIwQjvK9t4lwVmwwRxKJWE5CZlgSNTd6j66fud7iNenZJnau0GoYtbkDF91Ik8 4BN25G2glxjksCXZE9Utk2w1BfQMeqUv78ayg7CpDQ+ycCocyq5j85L7x0ywdPac XzJnAs/3+58sLEoVGH79qae2qFVxCaM5zaWfrTNgyCFSeIUok1Q= =9u/6 -----END PGP SIGNATURE-----