In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
CVSS Details
- CVSS 3.1 Base Score: 3.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-devel | May 4, 2022 | Jul 27, 2020 |
| Alpine Linux | — | Upgrade freerdp2Upgrade freerdp | Aug 22, 2024 | Jul 27, 2020 |
| Centos_linux | — | Upgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade freerdpUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp-debugsource | Jun 1, 2021 | Jul 27, 2020 |
| Debian | — | Upgrade freerdp2 | Oct 10, 2023 | Jul 27, 2020 |
| Freebsd | — | Upgrade freerdp | Jul 29, 2020 | Jul 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdp-libsUpgrade freerdpUpgrade libwinpr | Apr 26, 2022 | Jul 27, 2020 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-devel | May 26, 2021 | Jul 20, 2020 |
| Redhat_linux | — | Upgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade libwinprNo solution existsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debugsource | May 21, 2021 | Jul 27, 2020 |
| Rocky_linux | — | Upgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade libwinpr | Mar 12, 2024 | Jul 27, 2020 |
| Suse | — | Upgrade freerdp-develUpgrade libwinpr2Upgrade freerdp-serverUpgrade freerdpUpgrade vinagre-langUpgrade libfreerdp2Upgrade winpr2-develUpgrade uwac0-0-develUpgrade freerdp-proxyUpgrade vinagreUpgrade libuwac0-0Upgrade freerdp-wayland | Aug 20, 2020 | Jul 27, 2020 |
| Ubuntu | — | Upgrade libfreerdp-server2-2Upgrade libfreerdp2-2Upgrade libfreerdp-client2-2 | Sep 2, 2020 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub