CVE-2018-8791 - rdesktop: Minor information leak in rdpdr_process

HIGH

rdesktop: Minor information leak in rdpdr_process

Published Feb 5, 2019

7.5

HIGH

CVSS 3.0

EPSS 3.83%

rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
All versions up to and including v1.8.3	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	rdesktop	Will not fix	n/a
Red Hat Enterprise Linux 6	rdesktop	Will not fix	n/a

No remediation recorded yet.

Weaknesses (3)

CWE-125

Out-of-bounds Read

CWE-126

CWE-200

Exposure of Sensitive Information

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html		vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/106938		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-8791		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1670403		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20400		Advisory
https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1		x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00030.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-8791
https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/		x_refsource_CONFIRMThird Party Advisory
https://security.gentoo.org/glsa/201903-06		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-8791
https://www.debian.org/security/2019/dsa-4394		vendor-advisoryx_refsource_DEBIANThird Party Advisory