Most recent entries from all

ALSA-2021:1849 — Moderate: freerdp security, bug fix, and enhancement update

Affected: AlmaLinux:8: freerdp-devel

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

The following packages have been upgraded to a later upstream version: freerdp (2.2.0). (BZ#1881971)

Security Fix(es):

* freerdp: out of bounds read in TrioParse (CVE-2020-4030)

* freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)

* freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)

* freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)

* freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)

* freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)

* freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)

* freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-01331

CLEANSTART-2024-IT09674 — In FreeRDP before version 2

Affected: CleanStart: freerdp

Security vulnerability affects the freerdp package. In FreeRDP before version 2.

cnvd-2020-35689

EUVD-2026-40349

fkie_cve-2020-11095

In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

gsd-2020-11095

OESA-2021-1008 — freerdp security update

Affected: openEuler:20.03-LTS: freerdp, openEuler:20.03-LTS-SP1: freerdp

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.\r\n\r\n Security Fix(es):\r\n\r\n libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.(CVE-2020-11526)\r\n\r\n In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.(CVE-2020-11044)\r\n\r\n In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.(CVE-2020-11042)\r\n\r\n In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.(CVE-2020-11095)\r\n\r\n In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.(CVE-2020-11045)\r\n\r\n libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.(CVE-2020-…

openSUSE-SU-2020:1090-1 — Security update for freerdp

Security update for freerdp

SUSE-SU-2020:2032-1 — Security update for freerdp

Security update for freerdp

UBUNTU-CVE-2020-11095

Affected: Ubuntu:16.04:LTS: freerdp, Ubuntu:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:20.04:LTS: freerdp2

WID-SEC-W-2026-2644 — Red Hat Enterprise Linux (FreeRDP): Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.