Name: CVE-2018-8786: Integer Overflow to Buffer Overflow
Creator: Rapid7
Published: 2018-11-29T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-8786, CWE-680, CWE-681, CWE-787, CVSS 9.8, EPSS 0.08156

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

CVSS Details

CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade freerdpUpgrade freerdp2	Apr 22, 2019	Nov 29, 2018
Amazon Linux Ami 2	—	Upgrade freerdp-pluginsUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-libs	Apr 27, 2020	Nov 29, 2018
Centos_linux	—	Upgrade freerdp-pluginsUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-libs	Apr 13, 2019	Nov 29, 2018
Debian	—	Upgrade freerdp2	Feb 20, 2019	Nov 29, 2018
Huawei Euleros 2_0_sp2	—	Upgrade freerdp-libsUpgrade freerdp-pluginsUpgrade freerdp	May 1, 2019	Nov 29, 2018
Huawei Euleros 2_0_sp3	—	Upgrade freerdpUpgrade freerdp-pluginsUpgrade freerdp-libs	May 1, 2019	Nov 29, 2018
Huawei Euleros 2_0_sp5	—	Upgrade freerdpUpgrade freerdp-libsUpgrade freerdp-plugins	May 1, 2019	Nov 29, 2018
Oracle_linux	—	Upgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-pluginsUpgrade freerdp	Jul 21, 2020	Oct 22, 2018
Redhat_linux	—	Upgrade freerdp-debuginfoNo solution existsUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-plugins	Apr 3, 2019	Nov 29, 2018
Suse	—	Upgrade libfreerdp2Upgrade freerdp-waylandUpgrade libuwac0-0Upgrade freerdp-proxyUpgrade winpr2-develUpgrade freerdpUpgrade vinagre-langUpgrade vinagreUpgrade uwac0-0-develUpgrade freerdp-develUpgrade libwinpr2Upgrade freerdp-server	Jan 22, 2019	Nov 29, 2018
Ubuntu	—	Upgrade libfreerdp2-2Upgrade libfreerdp-client1.1Upgrade libfreerdp1Upgrade libfreerdp-client2-2	Jan 10, 2019	Nov 29, 2018

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence