In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
CVSS Details
- CVSS 3.1 Base Score: 3.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-devel | May 4, 2022 | Jul 27, 2020 |
| Alpine Linux | — | Upgrade freerdp2Upgrade freerdp | Aug 22, 2024 | Jul 27, 2020 |
| Centos_linux | — | Upgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr | Jun 1, 2021 | Jul 27, 2020 |
| Debian | — | Upgrade freerdp2 | Oct 10, 2023 | Jul 27, 2020 |
| Freebsd | — | Upgrade freerdp | Jul 29, 2020 | Jul 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp | Apr 26, 2022 | Jul 27, 2020 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | May 26, 2021 | Jul 20, 2020 |
| Redhat_linux | — | Upgrade libwinpr-debuginfoNo solution existsUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debugsource | May 21, 2021 | Jul 27, 2020 |
| Rocky_linux | — | Upgrade freerdp-develUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp | Mar 12, 2024 | Jul 27, 2020 |
| Suse | — | Upgrade freerdpUpgrade freerdp-develUpgrade libwinpr2Upgrade freerdp-serverUpgrade freerdp-proxyUpgrade vinagreUpgrade freerdp-waylandUpgrade vinagre-langUpgrade uwac0-0-develUpgrade libfreerdp2Upgrade libuwac0-0Upgrade winpr2-devel | Aug 20, 2020 | Jul 27, 2020 |
| Ubuntu | — | Upgrade libfreerdp-client2-2Upgrade libfreerdp-server2-2Upgrade libfreerdp2-2 | Sep 2, 2020 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub