FEDORA-EPEL-2026-ff046d13ab — security update for xrdp

stable

xrdp-0.10.6-1.el9

FEDORA-EPEL-2026-ff046d13ab created by bojan 5 months ago for Fedora EPEL 9

Security fixes

CVE-2026-32105
CVE-2026-32107
CVE-2026-32623
CVE-2026-32624
CVE-2026-33145
CVE-2026-33516
CVE-2026-33689
CVE-2026-35512

New features

Support for xorgxrdp bug fixes #249 and #342 (#3721)

Bug fixes

Honour pass_shell_as_env setting only if user sets a shell (#3725)
We no longer try to create a NULL authentication file when using VNC over UDS (#3727)
Problems with the Brazilian ABNT2 keyboard mapping have been corrected (#3728 3736)
A 'file exists' error when installing xrdp over an existing installation has been addressed (#3780)

This update has been submitted for testing by bojan.

5 months ago

This update's test gating status has been changed to 'ignored'.

5 months ago

This update has been pushed to testing.

5 months ago

bojan edited this update.

5 months ago

bojan edited this update.

5 months ago

bojan edited this update.

5 months ago

This update has been submitted for stable by bodhi.

5 months ago

This update has been pushed to stable.

5 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

5 months ago

in testing

5 months ago

in stable

5 months ago

modified

5 months ago

approved

5 months ago

Builds

xrdp-0.10.6-1.el9

BZ#2459297 CVE-2026-32105 xrdp: xrdp: Data integrity compromised due to missing MAC signature verification in Classic RDP Security [epel-all]

BZ#2459300 CVE-2026-32107 xrdp: xrdp: Privilege Escalation via improper privilege management [epel-all]

BZ#2459615 CVE-2026-33145 xrdp: xrdp: Arbitrary Command Execution via unsafe handling of AlternateShell parameter [epel-all]

BZ#2459617 CVE-2026-32623 xrdp: xrdp NeutrinoRDP: Remote Code Execution or Denial of Service via heap-based buffer overflow in fragmented RDP data handling [epel-all]

BZ#2459619 CVE-2026-35512 xrdp: xrdp: Remote Code Execution via heap-based buffer overflow [epel-all]

BZ#2459622 CVE-2026-33689 xrdp: xrdp: Denial of Service and Information Disclosure via Out-of-Bounds Read [epel-all]

BZ#2459624 CVE-2026-33516 xrdp: xrdp: Denial of Service and Information Disclosure via specially crafted RDP message [epel-all]

BZ#2459626 CVE-2026-32624 xrdp: xrdp: Denial of Service via crafted username and domain name [epel-all]

xrdp-0.10.6-1.el9

Automated Test Results

ignored