Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xrdp for openSUSE:Factory checked in at 2026-08-18 16:37:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xrdp (Old) and /work/SRC/openSUSE:Factory/.xrdp.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xrdp" Tue Aug 18 16:37:02 2026 rev:65 rq:1371632 version:0.10.6.1 Changes: -------- --- /work/SRC/openSUSE:Factory/xrdp/xrdp.changes 2026-06-25 10:59:00.877108981 +0200 +++ /work/SRC/openSUSE:Factory/.xrdp.new.1258/xrdp.changes 2026-08-18 16:37:45.685675371 +0200 @@ -1,0 +2,18 @@ +Tue Jul 21 08:35:50 UTC 2026 - Yifan Jiang <[email protected]> + +- Update to version 0.10.6.1: + + Security fixes + CVE-2026-41252 (bsc#1271926) + CVE-2026-41521 (bsc#1271927) + CVE-2026-44178 (bsc#1271929) + CVE-2026-42218 (bsc#1271928) + CVE-2026-44978 (bsc#1271943) + CVE-2026-54538 (bsc#1271938) + CVE-2026-55238 (bsc#1271939) + CVE-2026-55626 (bsc#1271940) + CVE-2026-55639 (bsc#1271941) + CVE-2026-55645 (bsc#1271942) + + Bug fixes + regression: Fix SEGV in xrdp when running over TLS (#3793) + +------------------------------------------------------------------- Old: ---- xrdp-0.10.6.tar.gz xrdp-0.10.6.tar.gz.asc New: ---- xrdp-0.10.6.1.tar.gz xrdp-0.10.6.1.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xrdp.spec ++++++ --- /var/tmp/diff_new_pack.sL6l7I/_old 2026-08-18 16:37:46.886718402 +0200 +++ /var/tmp/diff_new_pack.sL6l7I/_new 2026-08-18 16:37:46.888718474 +0200 @@ -22,7 +22,7 @@ %endif Name: xrdp -Version: 0.10.6 +Version: 0.10.6.1 Release: 0 Summary: Remote desktop protocol (RDP) server License: Apache-2.0 AND GPL-2.0-or-later ++++++ xrdp-0.10.6.tar.gz -> xrdp-0.10.6.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/NEWS.md new/xrdp-0.10.6.1/NEWS.md --- old/xrdp-0.10.6/NEWS.md 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/NEWS.md 2026-07-07 03:05:19.000000000 +0200 @@ -1,3 +1,43 @@ +# Release notes for xrdp v0.10.6.1 (2026/07/06) + +## General announcements + +This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerability fix in the previous release. + +If you like xrdp, please consider sponsoring or donating to the project. We accept financial contributions through [Open Collective](https://opencollective.com/xrdp-project), and direct donations to individual developers via GitHub Sponsors are also welcome. + +## Security fixes + +- [CVE-2026-41252](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-w5vg-6qmv-j63j) +- [CVE-2026-41521](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-v8w6-pf78-9458) +- [CVE-2026-44178](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4) +- [CVE-2026-42218](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3wr5-fwmh-qh34) +- [CVE-2026-44978](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj) +- [CVE-2026-54538](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9j3q-9mvw-qv7j) +- [CVE-2026-55238](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-mg8j-x9rw-9xv3) +- [CVE-2026-55626](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r) +- [CVE-2026-55639](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-6g36-mxcf-r3gc) +- [CVE-2026-55645](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3m4m-h22g-c7xx) + +## New features +None + +## Bug fixes +- regression: Fix SEGV in xrdp when running over TLS (#3793) + +## Internal changes +- CI: Switch FreeBSD CI from Cirrus CI to GitHub Actions (#3800) + +## Changes for users +None + +## Changes for packagers or developers +* (from v0.10.3) The `--enable-utmp` needs to be added to enable UTMP support. +* (from v0.10.3) The config file subdirectory (`xrdp` part of `/etc/xrdp`) can now be configured (#3369) +* (from v0.10.3) Packagers using TigerVNC to provide the Xvnc backend may wish to configure the 'Xvnc over UDS' session type as a default by using a `code=1` line in xrdp.ini. Instructions are provided in the released xrdp.ini file. +* The unfinished PIV smartcard support is now disabled by default, but can be re-enabled by adding `--enable-smartcard` to the configure command. Because of possible security issues with this code, this should only be done by developers working in non-production environments (#3759) +----------------------- + # Release notes for xrdp v0.10.6 (2026/04/17) ## General announcements @@ -11,7 +51,7 @@ ## Security fixes -Thanks to @explitintel, @smittix and @hessandrew! +Thanks to @exploitintel, @smittix and @hessandrew! - [CVE-2026-32105](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3) - [CVE-2026-32107](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9) @@ -23,7 +63,7 @@ - [CVE-2026-35512](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-jg6p-7fg8-9hh6) ## New features -- Support for xorgxrdp bug fixes #249 and #342 (#3721) +- Support for xorgxrdp bug fixes neutrinolabs/xorgxrdp#249 and neutrinolabs/xorgxrdp#342 (#3721) ## Bug fixes - Honour `pass_shell_as_env` setting only if user sets a shell (#3725) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/configure new/xrdp-0.10.6.1/configure --- old/xrdp-0.10.6/configure 2026-04-17 16:24:10.000000000 +0200 +++ new/xrdp-0.10.6.1/configure 2026-07-07 03:07:13.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for xrdp 0.10.6. +# Generated by GNU Autoconf 2.71 for xrdp 0.10.6.1. # # Report bugs to <[email protected]>. # @@ -621,8 +621,8 @@ # Identity of this package. PACKAGE_NAME='xrdp' PACKAGE_TARNAME='xrdp' -PACKAGE_VERSION='0.10.6' -PACKAGE_STRING='xrdp 0.10.6' +PACKAGE_VERSION='0.10.6.1' +PACKAGE_STRING='xrdp 0.10.6.1' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='' @@ -1532,7 +1532,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures xrdp 0.10.6 to adapt to many kinds of systems. +\`configure' configures xrdp 0.10.6.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1607,7 +1607,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of xrdp 0.10.6:";; + short | recursive ) echo "Configuration of xrdp 0.10.6.1:";; esac cat <<\_ACEOF @@ -1822,7 +1822,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -xrdp configure 0.10.6 +xrdp configure 0.10.6.1 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2486,7 +2486,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by xrdp $as_me 0.10.6, which was +It was created by xrdp $as_me 0.10.6.1, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3978,7 +3978,7 @@ # Define the identity of the package. PACKAGE='xrdp' - VERSION='0.10.6' + VERSION='0.10.6.1' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -23352,7 +23352,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by xrdp $as_me 0.10.6, which was +This file was extended by xrdp $as_me 0.10.6.1, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -23420,7 +23420,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -xrdp config.status 0.10.6 +xrdp config.status 0.10.6.1 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/configure.ac new/xrdp-0.10.6.1/configure.ac --- old/xrdp-0.10.6/configure.ac 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/configure.ac 2026-07-07 03:05:19.000000000 +0200 @@ -1,7 +1,7 @@ # Process this file with autoconf to produce a configure script AC_PREREQ([2.69]) -AC_INIT([xrdp], [0.10.6], [[email protected]]) +AC_INIT([xrdp], [0.10.6.1], [[email protected]]) AC_DEFINE([VERSION_YEAR], 2026, [Copyright year]) AC_CONFIG_HEADERS(config_ac.h:config_ac-h.in) AM_INIT_AUTOMAKE([1.7.2 foreign]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/libxrdp/xrdp_caps.c new/xrdp-0.10.6.1/libxrdp/xrdp_caps.c --- old/xrdp-0.10.6/libxrdp/xrdp_caps.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/libxrdp/xrdp_caps.c 2026-07-07 03:05:19.000000000 +0200 @@ -415,6 +415,11 @@ int inputFlags; int client_does_fastpath_input; + if (len < 2) + { + LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_input: missing data"); + return 1; + } in_uint16_le(s, inputFlags); client_does_fastpath_input = (inputFlags & INPUT_FLAG_FASTPATH_INPUT) || (inputFlags & INPUT_FLAG_FASTPATH_INPUT2); @@ -668,6 +673,11 @@ { int MaxRequestSize; + if (len < 4) + { + LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_multifragmentupdate: missing data"); + return 1; + } in_uint32_le(s, MaxRequestSize); if (self->client_info.use_fast_path & 1) { @@ -683,6 +693,11 @@ { int largePointerSupportFlags; + if (len < 2) + { + LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_largepointer: missing data"); + return 1; + } in_uint16_le(s, largePointerSupportFlags); self->client_info.large_pointer_support_flags = largePointerSupportFlags; return 0; @@ -692,16 +707,25 @@ static int xrdp_caps_process_frame_ack(struct xrdp_rdp *self, struct stream *s, int len) { + int max_count; LOG_DEVEL(LOG_LEVEL_TRACE, "xrdp_caps_process_frame_ack:"); - self->client_info.use_frame_acks = 1; - in_uint32_le(s, self->client_info.max_unacknowledged_frame_count); - if (self->client_info.max_unacknowledged_frame_count < 0) + if (len < 4) { - LOG(LOG_LEVEL_WARNING, " invalid max_unacknowledged_frame_count value (%d), setting to 0", - self->client_info.max_unacknowledged_frame_count); - self->client_info.max_unacknowledged_frame_count = 0; + LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_frame_ack: missing data"); + return 1; } - LOG_DEVEL(LOG_LEVEL_TRACE, " max_unacknowledged_frame_count %d", self->client_info.max_unacknowledged_frame_count); + self->client_info.use_frame_acks = 1; + in_uint32_le(s, max_count); + if (max_count < 0) + { + LOG(LOG_LEVEL_WARNING, + " invalid max_unacknowledged_frame_count value (%d), setting to 0", + max_count); + max_count = 0; + } + LOG_DEVEL(LOG_LEVEL_TRACE, + " max_unacknowledged_frame_count %d", max_count); + self->client_info.max_unacknowledged_frame_count = max_count; return 0; } @@ -715,6 +739,12 @@ logging in debug mode */ UNUSED_VAR(cmdFlags); #endif + // Check the data is there, whether or not we are logging it + if (len < 8) + { + LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_surface_cmds: missing data"); + return 1; + } LOG_DEVEL(LOG_LEVEL_TRACE, "xrdp_caps_process_surface_cmds:"); in_uint32_le(s, cmdFlags); @@ -802,22 +832,34 @@ case CAPSTYPE_GENERAL: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_GENERAL"); - xrdp_caps_process_general(self, s, len); + if (xrdp_caps_process_general(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_BITMAP: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_BITMAP"); - xrdp_caps_process_bitmap(self, s, len); + if (xrdp_caps_process_bitmap(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_ORDER: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_ORDER"); - xrdp_caps_process_order(self, s, len); + if (xrdp_caps_process_order(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_BITMAPCACHE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_BITMAPCACHE"); - xrdp_caps_process_bmpcache(self, s, len); + if (xrdp_caps_process_bmpcache(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_CONTROL: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " @@ -826,7 +868,10 @@ case 6: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = 6"); - xrdp_caps_process_cache_v3_codec_id(self, s, len); + if (xrdp_caps_process_cache_v3_codec_id(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_ACTIVATION: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " @@ -835,7 +880,10 @@ case CAPSTYPE_POINTER: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_POINTER"); - xrdp_caps_process_pointer(self, s, len); + if (xrdp_caps_process_pointer(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_SHARE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " @@ -852,7 +900,10 @@ case CAPSTYPE_INPUT: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_INPUT"); - xrdp_caps_process_input(self, s, len); + if (xrdp_caps_process_input(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_FONT: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " @@ -861,22 +912,34 @@ case CAPSTYPE_BRUSH: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_BRUSH"); - xrdp_caps_process_brushcache(self, s, len); + if (xrdp_caps_process_brushcache(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_GLYPHCACHE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_GLYPHCACHE"); - xrdp_caps_process_glyphcache(self, s, len); + if (xrdp_caps_process_glyphcache(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_OFFSCREENCACHE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_OFFSCREENCACHE"); - xrdp_caps_process_offscreen_bmpcache(self, s, len); + if (xrdp_caps_process_offscreen_bmpcache(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_BITMAPCACHE_REV2: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_BITMAPCACHE_REV2"); - xrdp_caps_process_bmpcache2(self, s, len); + if (xrdp_caps_process_bmpcache2(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_VIRTUALCHANNEL: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " @@ -893,37 +956,58 @@ case CAPSTYPE_RAIL: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_RAIL"); - xrdp_caps_process_rail(self, s, len); + if (xrdp_caps_process_rail(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_WINDOW: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_WINDOW"); - xrdp_caps_process_window(self, s, len); + if (xrdp_caps_process_window(self, s, len) != 0) + { + return 1; + } break; case CAPSSETTYPE_MULTIFRAGMENTUPDATE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSSETTYPE_MULTIFRAGMENTUPDATE"); - xrdp_caps_process_multifragmentupdate(self, s, len); + if (xrdp_caps_process_multifragmentupdate(self, s, len) != 0) + { + return 1; + } break; case CAPSETTYPE_LARGE_POINTER: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSETTYPE_LARGE_POINTER"); - xrdp_caps_process_largepointer(self, s, len); + if (xrdp_caps_process_largepointer(self, s, len) != 0) + { + return 1; + } break; case CAPSETTYPE_SURFACE_COMMANDS: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSETTYPE_SURFACE_COMMANDS"); - xrdp_caps_process_surface_cmds(self, s, len); + if (xrdp_caps_process_surface_cmds(self, s, len) != 0) + { + return 1; + } break; case CAPSSETTYPE_BITMAP_CODECS: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSSETTYPE_BITMAP_CODECS"); - xrdp_caps_process_codecs(self, s, len); + if (xrdp_caps_process_codecs(self, s, len) != 0) + { + return 1; + } break; case CAPSTYPE_FRAME_ACKNOWLEDGE: LOG_DEVEL(LOG_LEVEL_INFO, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " "capabilitySetType = CAPSTYPE_FRAME_ACKNOWLEDGE"); - xrdp_caps_process_frame_ack(self, s, len); + if (xrdp_caps_process_frame_ack(self, s, len) != 0) + { + return 1; + } break; default: LOG(LOG_LEVEL_WARNING, "Received [MS-RDPBCGR] TS_CONFIRM_ACTIVE_PDU - TS_CAPS_SET " diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/libxrdp/xrdp_rdp.c new/xrdp-0.10.6.1/libxrdp/xrdp_rdp.c --- old/xrdp-0.10.6/libxrdp/xrdp_rdp.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/libxrdp/xrdp_rdp.c 2026-07-07 03:05:19.000000000 +0200 @@ -543,23 +543,26 @@ { s->next_packet = 0; *code = 0; - LOG(LOG_LEVEL_ERROR, "xrdp_rdp_recv: out code 0 (skip data) " - "bad RDP packet"); - return 0; + LOG(LOG_LEVEL_ERROR, "xrdp_rdp_recv: out code 0 bad RDP packet"); + return 1; } - else + in_uint16_le(s, len); /* totalLength */ + in_uint16_le(s, pdu_code); /* pduType */ + in_uint8s(s, 2); /* pduSource */ + // Length must be at least the size of TS_SHARECONTROLHEADER, and + // cannot fall beyond the end of the PDU + if (len < 6 || !s_check_rem(s, len - 6)) { - in_uint16_le(s, len); /* totalLength */ - in_uint16_le(s, pdu_code); /* pduType */ - *code = pdu_code & 0xf; - in_uint8s(s, 2); /* pduSource */ - s->next_packet += len; - LOG_DEVEL(LOG_LEVEL_TRACE, "Received header [MS-RDPBCGR] TS_SHARECONTROLHEADER " - "totalLength %d, pduType.type %s (%d), pduType.PDUVersion %d, " - "pduSource (ignored)", len, PDUTYPE_TO_STR(*code), *code, - ((pdu_code & 0xfff0) >> 4)); - return 0; + LOG(LOG_LEVEL_ERROR, "bad TS_SHARECONTROLHEADER length 0x%04X", len); + return 1; } + *code = pdu_code & 0xf; + s->next_packet += len; + LOG_DEVEL(LOG_LEVEL_TRACE, "Received header [MS-RDPBCGR] TS_SHARECONTROLHEADER " + "totalLength %d, pduType.type %s (%d), pduType.PDUVersion %d, " + "pduSource (ignored)", len, PDUTYPE_TO_STR(*code), *code, + ((pdu_code & 0xfff0) >> 4)); + return 0; } /*****************************************************************************/ @@ -1159,6 +1162,10 @@ { int action; + if (!s_check_rem_and_log(s, 8, "Parsing [MS-RDPBCGR] TS_CONTROL_PDU")) + { + return 1; + } in_uint16_le(s, action); in_uint8s(s, 2); /* user id */ in_uint8s(s, 4); /* control id */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/libxrdp/xrdp_sec.c new/xrdp-0.10.6.1/libxrdp/xrdp_sec.c --- old/xrdp-0.10.6/libxrdp/xrdp_sec.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/libxrdp/xrdp_sec.c 2026-07-07 03:05:19.000000000 +0200 @@ -1396,7 +1396,7 @@ int ver; int len; int pad; - const char *data_signature; + char data_signature[8] = {0}; #ifndef USE_DEVEL_LOGGING /* TODO: remove UNUSED_VAR once the `ver` variable is used for more than @@ -1432,8 +1432,15 @@ } /* remainder of TS_FP_INPUT_PDU */ - in_uint8p(s, data_signature, 8); + in_uint8a(s, data_signature, sizeof(data_signature)); + // Decrypt the packet, and subtract the padding length, + // after checking the validity xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p)); + if (pad > 7 || pad > (int)(s->end - s->p)) + { + LOG(LOG_LEVEL_ERROR, "Bad padding for TS_FP_FIPS_INFO PDU"); + return 1; + } s->end -= pad; if (!xrdp_sec_fips_check_sig(self, data_signature, 8, s->p, (int)(s->end - s->p))) @@ -1450,7 +1457,7 @@ return 1; } /* remainder of TS_FP_INPUT_PDU */ - in_uint8p(s, data_signature, 8); + in_uint8a(s, data_signature, sizeof(data_signature)); xrdp_sec_decrypt(self, s->p, (int)(s->end - s->p)); if (!xrdp_sec_check_sig(self, data_signature, 8, s->p, (int)(s->end - s->p))) @@ -1482,7 +1489,7 @@ ", numEvents %d", self->fastpath_layer->secFlags, (self->fastpath_layer->secFlags & FASTPATH_INPUT_ENCRYPTED) ? "(see above)" : "(not present)", - sig64_to_uint64(data_signature, 8), + sig64_to_uint64(data_signature, sizeof(data_signature)), self->fastpath_layer->numEvents); return 0; @@ -1496,7 +1503,6 @@ int len; int ver; int pad; - const char *data_signature; if (xrdp_mcs_recv(self->mcs_layer, s, chan) != 0) { @@ -1530,6 +1536,8 @@ if (flags & SEC_ENCRYPT) /* 0x08 */ { + char *data_signature = NULL; + if (self->crypt_level == CRYPT_LEVEL_FIPS) { if (!s_check_rem_and_log(s, 12, "Parsing [MS-RDPBCGR] TS_SECURITY_HEADER2")) @@ -1558,7 +1566,14 @@ "has unexpected version. Expected 1, actual %d", ver); return 1; } + // Decrypt the packet, and subtract the padding length, + // after checking the validity xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p)); + if (pad > 7 || pad > (int)(s->end - s->p)) + { + LOG(LOG_LEVEL_ERROR, "Bad padding for TS_SECURITY_HEADER2 PDU"); + return 1; + } s->end -= pad; if (!xrdp_sec_fips_check_sig(self, data_signature, 8, s->p, (int)(s->end - s->p))) @@ -2150,6 +2165,10 @@ int crypt_method; int found; + if (!s_check_rem_and_log(s, 4, "Parsing [MS-RDPBCGR] CS_SECURITY")) + { + return 1; + } in_uint32_le(s, crypt_method); LOG_DEVEL(LOG_LEVEL_TRACE, "Received [MS-RDPBCGR] TS_UD_CS_SEC " "encryptionMethods 0x%8.8x, extEncryptionMethods (ignored)", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/sesman/sesexec/login_info.c new/xrdp-0.10.6.1/sesman/sesexec/login_info.c --- old/xrdp-0.10.6/sesman/sesexec/login_info.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/sesman/sesexec/login_info.c 2026-07-07 03:05:19.000000000 +0200 @@ -41,6 +41,17 @@ #include "sesexec.h" #include "string_calls.h" +// Sys login fails all take a fixed time before returning. This +// prevents an attacker using timing differences to determine +// information about the users on the system (CVE-2026-42218) +// +// Note that some systems may provide an upper time bound for +// a login failure that is higher than this. For example, the Linux +// PAM stack default sys login fail time is around 2000 milli-seconds. +// Consequently, it is important the auth stack is always called, even +// if it has been determined that this is unnecessary. +#define FAILED_LOGIN_CONSTANT_TIME 600 // milli-seconds + /******************************************************************************/ /** * Logs an authentication failure message @@ -72,7 +83,6 @@ * @return Status for the operation * * @post If E_SCP_LOGIN_OK is returned, g_login_info is filled in - * */ static enum scp_login_status authenticate_and_authorize_connection(const char *supplied_username, @@ -84,6 +94,7 @@ char *username; // From reverse-looking up the UID enum scp_login_status status; struct auth_info *auth_info; + int start_time = g_time3(); if (g_getuser_info_by_name(supplied_username, &uid, NULL, NULL, NULL, NULL) != 0) @@ -93,6 +104,11 @@ supplied_username); log_authfail_message(supplied_username, ip_addr); status = E_SCP_LOGIN_NOT_AUTHENTICATED; + + /* Call the auth stack anyway. On some systems (e.g. linux-pam), + * a fixed delay is built in to the stack for an unsuccessful + * login, and this delay may exceed FAILED_LOGIN_CONSTANT_TIME */ + auth_end(auth_userpass(supplied_username, password, ip_addr, NULL)); } else if (g_getuser_info_by_uid(uid, &username, @@ -100,6 +116,7 @@ { LOG(LOG_LEVEL_ERROR, "Can't reverse lookup UID %d", uid); status = E_SCP_LOGIN_NOT_AUTHENTICATED; + auth_end(auth_userpass(supplied_username, password, ip_addr, NULL)); } else { @@ -179,6 +196,15 @@ g_free(username); } + + if (status != E_SCP_LOGIN_OK) + { + int elapsed_ms = g_time3() - start_time; + if (elapsed_ms > 0 && elapsed_ms < FAILED_LOGIN_CONSTANT_TIME) + { + g_sleep(FAILED_LOGIN_CONSTANT_TIME - elapsed_ms); + } + } return status; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/sesman/sesexec/session.c new/xrdp-0.10.6.1/sesman/sesexec/session.c --- old/xrdp-0.10.6/sesman/sesexec/session.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/sesman/sesexec/session.c 2026-07-07 03:05:19.000000000 +0200 @@ -469,6 +469,7 @@ "%d", 0660); /* rw-rw---- */ list_add_strdup_multi(params, + "-rfbport", "-1", "-rfbunixpath", port, "-rfbunixmode", sock_mode, "-SecurityTypes", "None", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/vnc/vnc.c new/xrdp-0.10.6.1/vnc/vnc.c --- old/xrdp-0.10.6/vnc/vnc.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/vnc/vnc.c 2026-07-07 03:05:19.000000000 +0200 @@ -30,6 +30,8 @@ #include <config_ac.h> #endif +#include <limits.h> + #include "vnc.h" #include "vnc_clip.h" #include "rfb.h" @@ -922,6 +924,25 @@ } /**************************************************************************//** + * Checks the size parameters from a framebuffer update are sane + * @param cx Width of update + * @param cy height of update + * @return 0 if the proposed sizes could result in overflow + * + * [MS-RDPBCGR] allows for a max desktop size of + * CLIENT_MONITOR_DATA_MAXIMUM_VIRTUAL_DESKTOP_WIDTH x + * CLIENT_MONITOR_DATA_MAXIMUM_VIRTUAL_DESKTOP_HEIGHT + * Each pixel needs up to 4 bytes + */ +static int +framebuffer_update_size_ok(int cx, int cy) +{ + return (cx <= CLIENT_MONITOR_DATA_MAXIMUM_VIRTUAL_DESKTOP_WIDTH && + cy <= CLIENT_MONITOR_DATA_MAXIMUM_VIRTUAL_DESKTOP_HEIGHT && + (cx * cy) <= (INT_MAX / 4)); +} + +/**************************************************************************//** * Parses an entire framebuffer update message from the wire, and returns the * first matching ExtendedDesktopSize encoding if found. * @@ -979,9 +1000,15 @@ in_uint16_be(s, cy); in_uint32_be(s, encoding); - if (encoding == RFB_ENC_EXTENDED_DESKTOP_SIZE && - !found && - match(x, y, cx, cy)) + if (!framebuffer_update_size_ok(cx, cy)) + { + LOG(LOG_LEVEL_ERROR, + "find_matching_extended_rect: Frame buffer too large"); + error = 1; + } + else if (encoding == RFB_ENC_EXTENDED_DESKTOP_SIZE && + !found && + match(x, y, cx, cy)) { LOG(LOG_LEVEL_DEBUG, "VNC matched ExtendedDesktopSize rectangle " @@ -1304,7 +1331,13 @@ in_uint16_be(s, cy); in_uint32_be(s, encoding); - if (encoding == RFB_ENC_RAW) + if (!framebuffer_update_size_ok(cx, cy)) + { + LOG(LOG_LEVEL_ERROR, + "lib_framebuffer_update: Frame buffer too large"); + error = 1; + } + else if (encoding == RFB_ENC_RAW) { need_size = cx * cy * get_bytes_per_pixel(v->server_bpp); init_stream(pixel_s, need_size); @@ -1452,6 +1485,13 @@ in_uint8s(s, 1); in_uint16_be(s, first_color); in_uint16_be(s, num_colors); + if ((first_color + num_colors) > VNC_PALETTE_SIZE) + { + LOG(LOG_LEVEL_ERROR, "lib_palette_update: palette overflow"); + free_stream(s); + return 1; + } + init_stream(s, 8192); error = trans_force_read_s(v->trans, s, num_colors * 6); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/vnc/vnc.h new/xrdp-0.10.6.1/vnc/vnc.h --- old/xrdp-0.10.6/vnc/vnc.h 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/vnc/vnc.h 2026-07-07 03:05:19.000000000 +0200 @@ -73,6 +73,8 @@ /* Defined in vnc_clip.c */ struct vnc_clipboard_data; +#define VNC_PALETTE_SIZE 256 + /* Defined in xrdp_client_info.h */ struct monitor_info; @@ -162,7 +164,7 @@ int server_bpp; char mod_name[256]; int mod_mouse_state; - int palette[256]; + int palette[VNC_PALETTE_SIZE]; int vnc_desktop; char username[256]; char password[256]; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/xrdp/xrdp.ini.in new/xrdp-0.10.6.1/xrdp/xrdp.ini.in --- old/xrdp-0.10.6/xrdp/xrdp.ini.in 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/xrdp/xrdp.ini.in 2026-07-07 03:05:19.000000000 +0200 @@ -287,27 +287,31 @@ #disabled_encodings_mask=0 ; Generic VNC Proxy -; Tailor this to specific hosts and VNC instances by specifying an ip +; To use this, remove the '#-#' prefix from the lines below. Tailor +; the section to specific hosts and VNC instances by specifying an ip ; and port and setting a suitable name. -[vnc-any] -name=vnc-any -lib=libvnc.@lib_extension@ -ip=ask -port=ask5900 -username=na -password=ask -#pamusername=asksame -#pampassword=asksame -#delay_ms=2000 -; Use one of these to connect to a chansrv instance created outside of sesman -; (e.g. as part of an x11vnc console session). Replace 'n' with the -; display number of the session, and (if applicable) 'u' with the numeric -; UID of the session. -; -; If 'username' or 'pamusername' is set, you probably don't need to use -; the two parameter variant with 'u'. -#chansrvport=DISPLAY(n) -#chansrvport=DISPLAY(n,u) +; This can be used with no customisations in test environments, but +; should always be locked down to specific hosts and/or ports in +; production. +#-#[vnc-any] +#-#name=vnc-any +#-#lib=libvnc.@lib_extension@ +#-#ip=ask +#-#port=ask5900 +#-#username=na +#-#password=ask +#-##pamusername=asksame +#-##pampassword=asksame +#-##delay_ms=2000 +#-#; Use one of these to connect to a chansrv instance created outside of sesman +#-#; (e.g. as part of an x11vnc console session). Replace 'n' with the +#-#; display number of the session, and (if applicable) 'u' with the numeric +#-#; UID of the session. +#-#; +#-#; If 'username' or 'pamusername' is set, you probably don't need to use +#-#; the two parameter variant with 'u'. +#-##chansrvport=DISPLAY(n) +#-##chansrvport=DISPLAY(n,u) ; Generic RDP proxy using NeutrinoRDP ; Tailor this to specific hosts by specifying an ip and port and setting diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xrdp-0.10.6/xrdp/xrdp_mm.c new/xrdp-0.10.6.1/xrdp/xrdp_mm.c --- old/xrdp-0.10.6/xrdp/xrdp_mm.c 2026-04-17 16:22:02.000000000 +0200 +++ new/xrdp-0.10.6.1/xrdp/xrdp_mm.c 2026-07-07 03:05:19.000000000 +0200 @@ -2326,16 +2326,19 @@ pro = (struct xrdp_process *) id; wm = pro->wm; + // Size of PDU sent to chansrv + int pdu_size = 8 + 8 + 4 + 4 + 4 + bytes; + trans = wm->mm->chan_trans; - s = trans_get_out_s(trans, 8192); + s = trans_get_out_s(trans, pdu_size); if (s == NULL) { return 1; } out_uint32_le(s, 0); /* version */ - out_uint32_le(s, 8 + 8 + 4 + 4 + 4 + bytes); + out_uint32_le(s, pdu_size); out_uint32_le(s, 17); /* msg id */ - out_uint32_le(s, 8 + 4 + 4 + 4 + bytes); + out_uint32_le(s, pdu_size - 8); chansrv_chan_id = wm->mm->xr2cr_cid_map[chan_id]; out_uint32_le(s, chansrv_chan_id); out_uint32_le(s, bytes); @@ -2358,16 +2361,19 @@ pro = (struct xrdp_process *) id; wm = pro->wm; + // Size of PDU sent to chansrv + int pdu_size = 8 + 8 + 4 + 4 + bytes; + trans = wm->mm->chan_trans; - s = trans_get_out_s(trans, 8192); + s = trans_get_out_s(trans, pdu_size); if (s == NULL) { return 1; } out_uint32_le(s, 0); /* version */ - out_uint32_le(s, 8 + 8 + 4 + 4 + bytes); + out_uint32_le(s, pdu_size); out_uint32_le(s, 19); /* msg id */ - out_uint32_le(s, 8 + 4 + 4 + bytes); + out_uint32_le(s, pdu_size - 8); chansrv_chan_id = wm->mm->xr2cr_cid_map[chan_id]; out_uint32_le(s, chansrv_chan_id); out_uint32_le(s, bytes); @@ -2763,38 +2769,39 @@ xrdp_mm_process_channel_data(struct xrdp_mm *self, tbus param1, tbus param2, tbus param3, tbus param4) { - struct stream *s; - int rv; - int length; - int total_length; - int flags; - int id; - char *data; - - rv = 0; + int rv = 0; if ((self->chan_trans != 0) && self->chan_trans->status == TRANS_STATUS_UP) { - s = trans_get_out_s(self->chan_trans, 8192); + int id = LOWORD(param1); + int flags = HIWORD(param1); + int length = param2; + const char *data = (const char *)param3; + int total_length = param4; - if (s != 0) + // Check passed-in lengths + if (length > 65535) { - id = LOWORD(param1); - flags = HIWORD(param1); - length = param2; - data = (char *)param3; - total_length = param4; + LOG(LOG_LEVEL_ERROR, "xrdp_mm_process_channel_data(): length overflow"); + return 1; + } - if (total_length < length) - { - LOG(LOG_LEVEL_WARNING, "WARNING in xrdp_mm_process_channel_data(): total_len < length"); - total_length = length; - } + if (total_length < length) + { + LOG(LOG_LEVEL_ERROR, "xrdp_mm_process_channel_data(): total_len < length"); + return 1; + } + + // Size of PDU sent to chansrv + int pdu_size = 8 + 8 + 2 + 2 + 2 + 4 + length; + struct stream *s = trans_get_out_s(self->chan_trans, pdu_size); + if (s != 0) + { out_uint32_le(s, 0); /* version */ - out_uint32_le(s, 8 + 8 + 2 + 2 + 2 + 4 + length); + out_uint32_le(s, pdu_size); out_uint32_le(s, 5); /* msg id */ - out_uint32_le(s, 8 + 2 + 2 + 2 + 4 + length); + out_uint32_le(s, pdu_size - 8); out_uint16_le(s, id); out_uint16_le(s, flags); out_uint16_le(s, length);
