xrdp-0.9.1-3.fc25

WARNING: Please note that this update comes with a slightly different syntax of sesman.ini file, so if you edited this file by hand, you may need to look at the .rpmnew file and merge any required changes by hand.

This release also creates three files in /etc/xrdp directory if they don’t already exist or are empty:

– rsakeys.ini
– cert.pem
– key.pem

Also note that in Fedora, the only backend that will really work is still Xvnc for now.

New features

– New xorgxrdp backend using existing Xorg with additional modules
– Improvements to X11rdp backend
– Support for IPv6 (disabled by default)
– Initial support for RemoteFX Codec (disabled by default)
– Support for TLS security layer (preferred over RDP layer if supported by the client)
– Support for disabling deprecated SSLv3 protocol and for selecting custom cipher suites in xrdp.ini
– Support for bidirectional fastpath (enabled in both directions by default)
– Support clients that don’t support drawing orders, such as MS RDP client for Android, ChromeRDP (disabled by default)
– More configurable login screen
– Support for new virtual channels:
– – rdpdr: device redirection
– – rdpsnd: audio output
– – cliprdr: clipboard
– – xrdpvr: xrdp video redirection channel (can be used along with NeutrinoRDP client)
– Support for disabling virtual channels globally or by session type
– Allow to specify the path for backends (Xorg, X11rdp, Xvnc)
– Added files for systemd support
– Multi-monitor support
– xrdp-chansrv stroes logs in ${XDG_DATA_HOME}/xrdp now

Security fixes

– User’s password could be recovered from the Xvnc password file
– X11 authentication was not used

CVE-2016-7477

The ff_put_pixels8_xy2_mmx function in rnd_template.c in Libav 11.7 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted mp3 file. NOTE: this issue was originally reported as involving a NULL pointer dereference.

CVE-2016-8675

The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.

CVE-2016-8680

The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.

CVE-2016-7393

Stack-based buffer overflow in the aac_sync function in aac_parser.c in Libav before 11.5 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

CVE-2016-8681

The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.

CVE-2016-8677

The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.

CVE-2016-8679

The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted file.

CVE-2016-8676

The get_vlc2 function in get_bits.h in Libav 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file. NOTE: this issue exists due to an incomplete fix for CVE-2016-8675.

CVE-2016-8674

The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file.