vulnerability

CentOS Linux: CVE-2021-41160: Important: freerdp security update (Multiple Advisories)

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Nov 11, 2021
Added
Nov 12, 2021
Modified
May 25, 2023

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.

Solution(s)

centos-upgrade-freerdpcentos-upgrade-freerdp-debuginfocentos-upgrade-freerdp-debugsourcecentos-upgrade-freerdp-develcentos-upgrade-freerdp-libscentos-upgrade-freerdp-libs-debuginfocentos-upgrade-libwinprcentos-upgrade-libwinpr-debuginfocentos-upgrade-libwinpr-devel
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.