Debian Patches

Status for xrdp/0.9.21.1-1+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
make-fixes.diff Build system fixes Thorsten Glaser <tg@mirbsd.org> yes
config.diff Use xorgxrdp instead of x11rdp Dominik George <nik@naturalnet.de> no
fix_perms.diff Fix permissions between xrdp and sesman. Attempt to fix connection problem between xrdp-sesman (running
as root) and xrdp (running as xrdp) by creating the socket for
the xorgxrdp server as 0660 in a sgid-xrdp directory, since we
can’t easily chgrp here; also fix retval check for listen(2)
https://github.com/neutrinolabs/xrdp/pull/464		 Thorsten Glaser <tg@mirbsd.org> yes
systemd.diff Fixes to systemd service files Dominik George <nik@naturalnet.de> yes
lfs.diff Enable Large File Support on (at least) 32-bit Linux Thorsten Glaser <tg@mirbsd.org> yes
pulse-debian.patch Use absolute path to PulseAudio modules The modules are installed to their locations by the
xrdp-build-pulse-modules script from the former
xrdp-pulseaudio-installer package. The upstream
pulseaudio-module-xrdp/wiki/README instructions
install the module into the PA directory and do
not need this patch.		 Dominik George <nik@naturalnet.de> no
var-run.diff Assume hard that /run → /var/run, to please lintian Thorsten Glaser <tg@mirbsd.org> invalid
document-certs.diff Document SSL certificate ownership needs Thorsten Glaser <tg@mirbsd.org> invalid debian
fix-environment.diff Initialise the environment properly Thorsten Glaser <tg@debian.org> yes debian
CVE-2023-40184.patch no
CVE-2023-42822.patch CVE-2023-42822
- font_items in struct xrdp_font renamed to chars to catch all
accesses to it. This name is consistent with the type of
the array elements (struct xrdp_font_char).
- Additional fields added to struct xrdp_font to allow for range
checking and for a default character to be provided
- Additional checks and logic added to xrdp_font_create()
- New macro XRDP_FONT_GET_CHAR() added to perform checked access
to chars field in struct xrdp_font		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2023-09-25
CVE-2024-39917.patch CVE-2024-39917 Abhijith PA <abhijith@debian.org> no (upstream|backport|vendor|other), (<patch-url>|commit:<commit-id>) 2025-02-27
CVE-2025-68670-Buffer-overflow-parsing-domain.patch CVE-2025-68670: Buffer overflow parsing domain
A potential overflow in xrdp_wm_parse_domain_information() is
addressed

(cherry picked from commit dd4b56c9873bd246ba3d815522b27d90c99fcc30)		 matt335672 <30179339+matt335672@users.noreply.github.com> no debian https://github.com/neutrinolabs/xrdp/commit/5cfd4817888c9a46e74db74e0e011182d04fa771 2025-12-18
CVE-2026-32105-1.patch security: Check HMAC on FIPS fastpath input
CVE-2026-32105: Add a check that the HMAC signature supplied with a
FIPS fastpath input PDU matches the calculated signature.

(cherry picked from commit 2a411f752591c0293a7698a452f00a46ef6c09bf)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-10
CVE-2026-32105-2.patch security: Check HMAC on FIPS slowpath input
CVE-2026-32105: Add a check that the HMAC signature supplied with a
FIPS slowpath input PDU matches the calculated signature.

(cherry picked from commit 0d8cf57e9d12393bd452a2b6cb1af0e38887d8a2)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-10
CVE-2026-32105-3.patch security: Check HMAC on non-FIPS slowpath input
CVE-2026-32105: Add a check that the HMAC signature supplied with a
non-FIPS slowpath input PDU matches the calculated signature.

(cherry picked from commit 759104912c64b33b2442ed788c1806e36d028db0)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-10
CVE-2026-32105-5.patch security: Check HMAC on non-FIPS fastpath input
CVE-2026-32105: Add a check that the HMAC signature supplied with a
non-FIPS fastpath input PDU matches the calculated signature.

(cherry picked from commit 187d22cef89e8d60091d52e4abf64b82c49d57ee)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-10
CVE-2026-32107.patch CVE-2026-32107 Abhijith PA <abhijith@debian.org> not-needed https://github.com/neutrinolabs/xrdp/commit/68b5ae9e2e3b3e040fe2174aa5fc652f0c5c67d1 2026-08-26
CVE-2026-32623.patch CVE-2026-32623: vulns in neutrinordp fragment reassembly
This PR addresses potential buffer overflows in fragment reassembly in
the neutrinordp shim by adding length and status checks.

(cherry picked from commit 3f0f7df6ffc639092b872600ac263db3af6bd643)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-09
CVE-2026-32624.patch CVE-2026-32624: buffer overflow if domain sep used
Check the username buffer is not overflowed if the domain separator
feature is used.

(cherry picked from commit f1a2bec41560ccc420931d94f07a18c31141c069)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-06
CVE-2026-33516.patch CVE-2026-33516 Abhijith PA <abhijith@debian.org> not-needed debian https://github.com/neutrinolabs/xrdp/commit/d2a8802c3124c103cd0c40aba661602420d01a73 2026-06-01
CVE-2026-33689.patch CVE-2026-33689: Fix length check on channel open
A check for at least two bytes remaining in a buffer should be 4 bytes.

(cherry picked from commit 3c131a9f5e2bd01fff4f5912c324ffad0fc71ab6)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-03-23
CVE-2026-41252.patch CVE-2026-41252: lib_palette_update Heap Buffer Overflow
(cherry picked from commit 9834a58ca65018d09b04ed7550dfa71aecb09b10)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-04-15
CVE-2026-41252-2.patch CVE-2026-41252 Abhijith PA <abhijith@debian.org> not-needed https://github.com/neutrinolabs/xrdp/commit/b07b78f170732480c5ecab010d2105ac74e8c0bd 2026-08-28
CVE-2026-41521.patch CVE-2026-41521: [V0.10] lib_framebuffer_update int overflow
An integer overflow can lead to possible heap info leak and ASLR
bypass.

(cherry picked from commit 2a94fc967465b7b569056d1607d9a98e14291515)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-04-15
CVE-2026-44178.patch CVE-2026-44178: Heap overflow in xrdp->chansrv msgs
Some xrdp -> chansrv messages allocate a fixed-size buffer which
can be overflowed by a malicious RDP client.

(cherry picked from commit 679faa64bc05a3959fcac888f36a768fad7dcce1)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-04-20
CVE-2026-44978.patch CVE-2026-44978: Check FIPS PDU padding value before use
(cherry picked from commit e42951868bcd2da2088da58fa20b31c1e2268c06		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-05-06
CVE-2026-54538.patch CVE-2026-54538: Pre-auth infinite loop in TS_SHARECONTROLHEADER

(cherry picked from commit 2394084bf46a8716ceeb66d1feccb65055d707dd)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-06-15
CVE-2026-55238.patch CVE-2026-55238: Possible OOB reads in capability processing
Add missing per-capability length checks in the RDP Confirm Active PDU
parser, and abort the parser if a buffer length violation is discovered.

(cherry picked from commit 4aa8bdf1eac3aab7e166393913019edf9616008c)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-06-11
CVE-2026-55639.patch CVE-2026-55639: OOB read in GCC Conference Create Request
(cherry picked from commit 9d16ec4e756b332e0e4cedea342890bca70a7042)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-06-15
CVE-2026-55645.patch CVE-2026-55645: OOB read in Client Control PDU processing
(cherry picked from commit b1edb60c1de4cbf2119f3a79358df32d5a1d2db0)		 matt335672 <30179339+matt335672@users.noreply.github.com> no 2026-06-15

All known versions for source package 'xrdp'

Links