CVE-2018-20177

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/106938Broken Link, Third Party Advisory, VDB Entry
https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1Patch
https://lists.debian.org/debian-lts-announce/2019/02/msg00030.htmlMailing List, Third Party Advisory
https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/Exploit, Third Party Advisory
https://security.gentoo.org/glsa/201903-06Third Party Advisory
https://www.debian.org/security/2019/dsa-4394Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/106938Broken Link, Third Party Advisory, VDB Entry
https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1Patch
https://lists.debian.org/debian-lts-announce/2019/02/msg00030.htmlMailing List, Third Party Advisory
https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/Exploit, Third Party Advisory
https://security.gentoo.org/glsa/201903-06Third Party Advisory
https://www.debian.org/security/2019/dsa-4394Third Party Advisory

Timeline

Published: Mar 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-201787.5rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial CVE-2018-201799.8rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_p CVE-2018-201809.8rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsndd CVE-2018-201819.8rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamles CVE-2018-201829.8rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() tha CVE-2018-201846.5In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attac CVE-2018-201855.3In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c CVE-2018-201866.5An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive m CVE-2018-201875.9A side-channel issue was discovered in Botan before 2.9.0. An attacker capable of precisely measuring the time taken for ECC key generation CVE-2018-201888.8FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.CVE-2018-201896.5In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib fil CVE-2018-20197.1IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data