In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
CVSS Details
- CVSS 3.1 Base Score: 3.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-devel | May 4, 2022 | Jul 27, 2020 |
| Alpine Linux | — | Upgrade freerdpUpgrade freerdp2 | Aug 22, 2024 | Jul 27, 2020 |
| Centos_linux | — | Upgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr | Jun 1, 2021 | Jul 27, 2020 |
| Debian | — | Upgrade freerdp2 | Oct 10, 2023 | Jul 27, 2020 |
| Freebsd | — | Upgrade freerdp | Jul 29, 2020 | Jul 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-libs | Apr 26, 2022 | Jul 27, 2020 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-devel | May 26, 2021 | Jul 20, 2020 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-develNo solution existsUpgrade freerdp-debuginfo | May 21, 2021 | Jul 27, 2020 |
| Rocky_linux | — | Upgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-debugsource | Mar 12, 2024 | Jul 27, 2020 |
| Suse | — | Upgrade libwinpr2Upgrade freerdpUpgrade freerdp-serverUpgrade freerdp-develUpgrade vinagreUpgrade vinagre-langUpgrade freerdp-proxyUpgrade libfreerdp2Upgrade uwac0-0-develUpgrade winpr2-develUpgrade freerdp-waylandUpgrade libuwac0-0 | Aug 20, 2020 | Jul 27, 2020 |
| Ubuntu | — | Upgrade libfreerdp-client2-2Upgrade libfreerdp-server2-2Upgrade libfreerdp2-2 | Sep 2, 2020 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub