In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
CVSS Details
- CVSS 3.1 Base Score: 3.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-devel | May 4, 2022 | Jul 27, 2020 |
| Alpine Linux | — | Upgrade freerdp2Upgrade freerdp | Aug 22, 2024 | Jul 27, 2020 |
| Centos_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp | Jun 1, 2021 | Jul 27, 2020 |
| Debian | — | Upgrade freerdp2 | Oct 10, 2023 | Jul 27, 2020 |
| Freebsd | — | Upgrade freerdp | Jul 29, 2020 | Jul 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-libs | Apr 26, 2022 | Jul 27, 2020 |
| Oracle_linux | — | Upgrade libwinprUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-devel | May 26, 2021 | Jul 20, 2020 |
| Redhat_linux | — | Upgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoNo solution existsUpgrade libwinpr | May 21, 2021 | Jul 27, 2020 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-devel | Mar 12, 2024 | Jul 27, 2020 |
| Suse | — | Upgrade freerdp-develUpgrade freerdpUpgrade freerdp-serverUpgrade libwinpr2Upgrade freerdp-waylandUpgrade vinagre-langUpgrade freerdp-proxyUpgrade uwac0-0-develUpgrade winpr2-develUpgrade libuwac0-0Upgrade vinagreUpgrade libfreerdp2 | Aug 20, 2020 | Jul 27, 2020 |
| Ubuntu | — | Upgrade libfreerdp2-2Upgrade libfreerdp-server2-2Upgrade libfreerdp-client2-2 | Sep 2, 2020 | Jul 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub