Security update for xrdp

Announcement ID:	SUSE-SU-2023:0340-1
Rating:	important
References:	bsc#1206300 bsc#1206303 bsc#1206306 bsc#1206307 bsc#1206310 bsc#1206311 bsc#1206312
Cross-References:	CVE-2022-23468 CVE-2022-23479 CVE-2022-23480 CVE-2022-23481 CVE-2022-23482 CVE-2022-23483 CVE-2022-23484
CVSS scores:	CVE-2022-23468 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2022-23468 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2022-23479 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23479 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-23480 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23480 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-23481 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23481 ( NVD ): 0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVE-2022-23482 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23482 ( NVD ): 0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVE-2022-23483 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23483 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-23484 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-23484 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9

An update that solves seven vulnerabilities can now be installed.

Description:

This update for xrdp fixes the following issues:

• CVE-2022-23468: Fixed a buffer overflow in xrdp_login_wnd_create() (bsc#1206300).
• CVE-2022-23479: Fixed a buffer overflow in xrdp_mm_chan_data_in() (bsc#1206303).
• CVE-2022-23480: Fixed a buffer overflow in devredir_proc_client_devlist_announce_req() (bsc#1206306).
• CVE-2022-23481: Fixed an out of bound read in xrdp_caps_process_confirm_active() (bsc#1206307).
• CVE-2022-23482: Fixed an out of bound read in xrdp_sec_process_mcs_data_CS_CORE() (bsc#1206310).
• CVE-2022-23483: Fixed an out of bound read in libxrdp_send_to_channel() (bsc#1206311).
• CVE-2022-23484: Fixed a integer overflow in xrdp_mm_process_rail_update_window_text() (bsc#1206312).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 9
  zypper in -t patch SUSE-OpenStack-Cloud-9-2023-340=1
• SUSE OpenStack Cloud Crowbar 9
  zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-340=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SAP-12-SP4-2023-340=1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-340=1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-340=1

Package List:

• SUSE OpenStack Cloud 9 (x86_64)
  • xrdp-debuginfo-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-debugsource-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-0.9.0~git.1456906198.f422461-21.30.2
• SUSE OpenStack Cloud Crowbar 9 (x86_64)
  • xrdp-debuginfo-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-debugsource-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-0.9.0~git.1456906198.f422461-21.30.2
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
  • xrdp-debuginfo-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-debugsource-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-0.9.0~git.1456906198.f422461-21.30.2
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64)
  • xrdp-debuginfo-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-debugsource-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-0.9.0~git.1456906198.f422461-21.30.2
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64)
  • xrdp-debuginfo-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-debugsource-0.9.0~git.1456906198.f422461-21.30.2
  • xrdp-0.9.0~git.1456906198.f422461-21.30.2

References:

• https://www.suse.com/security/cve/CVE-2022-23468.html
• https://www.suse.com/security/cve/CVE-2022-23479.html
• https://www.suse.com/security/cve/CVE-2022-23480.html
• https://www.suse.com/security/cve/CVE-2022-23481.html
• https://www.suse.com/security/cve/CVE-2022-23482.html
• https://www.suse.com/security/cve/CVE-2022-23483.html
• https://www.suse.com/security/cve/CVE-2022-23484.html
• https://bugzilla.suse.com/show_bug.cgi?id=1206300
• https://bugzilla.suse.com/show_bug.cgi?id=1206303
• https://bugzilla.suse.com/show_bug.cgi?id=1206306
• https://bugzilla.suse.com/show_bug.cgi?id=1206307
• https://bugzilla.suse.com/show_bug.cgi?id=1206310
• https://bugzilla.suse.com/show_bug.cgi?id=1206311
• https://bugzilla.suse.com/show_bug.cgi?id=1206312