git: 4f024b963a2d - main - security/vuxml: Document xrdp RCE vulnerability

From: Koichiro Iwao <meta_at_FreeBSD.org>
Date: Fri, 30 Jan 2026 13:02:42 UTC 
The branch main has been updated by meta:

URL: https://cgit.FreeBSD.org/ports/commit/?id=4f024b963a2d48f7c00362d8b47a1b185eb7df27

commit 4f024b963a2d48f7c00362d8b47a1b185eb7df27
Author:     Koichiro Iwao <meta@FreeBSD.org>
AuthorDate: 2026-01-30 02:52:33 +0000
Commit:     Koichiro Iwao <meta@FreeBSD.org>
CommitDate: 2026-01-30 13:02:08 +0000

    security/vuxml: Document xrdp RCE vulnerability
    
    Security:       https://www.cve.org/CVERecord?id=CVE-2025-68670
    Security:       https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f
---
 security/vuxml/vuln/2026.xml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index f2e8c68c451f..bcfd780ce523 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,29 @@
+  <vuln vid="232e16cc-fd83-11f0-981a-98b78501ef2a">
+    <topic>xrdp -- remote code execution</topic>
+    <affects>
+<package>
+<name>xrdp</name>
+<range><lt>0.10.5</lt></range>
+</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Denis Skvortsov, Security Researcher at Kaspersky reports:</p>
+	<blockquote cite="https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f">
+	  <p>xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-68670</cvename>
+      <url>https://www.cve.org/CVERecord?id=CVE-2025-68670</url>
+    </references>
+    <dates>
+      <discovery>2025-12-06</discovery>
+      <entry>2026-01-27</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="8173e68a-88f3-4862-882c-6e58779d98e7">
     <topic>zeek -- potential DoS vulnerability</topic>
     <affects>