CVE-2008-1803

2008-05-1222:20:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.107

Percentile

95.2%

JSON

Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channel_process function was not specified by the original researcher.

OSVersionArchitecturePackageVersionFilename
Debian12allrdesktop< 1.5.0-4+cvs20071006rdesktop_1.5.0-4+cvs20071006_all.deb
Debian11allrdesktop< 1.5.0-4+cvs20071006rdesktop_1.5.0-4+cvs20071006_all.deb
Debian999allrdesktop< 1.5.0-4+cvs20071006rdesktop_1.5.0-4+cvs20071006_all.deb
Debian13allrdesktop< 1.5.0-4+cvs20071006rdesktop_1.5.0-4+cvs20071006_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	rdesktop	< 1.5.0-4+cvs20071006	rdesktop_1.5.0-4+cvs20071006_all.deb
Debian	11	all	rdesktop	< 1.5.0-4+cvs20071006	rdesktop_1.5.0-4+cvs20071006_all.deb
Debian	999	all	rdesktop	< 1.5.0-4+cvs20071006	rdesktop_1.5.0-4+cvs20071006_all.deb
Debian	13	all	rdesktop	< 1.5.0-4+cvs20071006	rdesktop_1.5.0-4+cvs20071006_all.deb