FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinprUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-libs | May 4, 2022 | Oct 21, 2021 |
| Alpine Linux | — | Upgrade freerdpUpgrade freerdp2 | Aug 22, 2024 | Oct 21, 2021 |
| Amazon Linux Ami 2 | — | Upgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | Jul 4, 2022 | Oct 21, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 21, 2021 |
| Centos_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-devel | Nov 12, 2021 | Nov 11, 2021 |
| Debian | — | Upgrade freerdp2 | Nov 20, 2023 | Oct 21, 2021 |
| Gentoo Linux | — | Upgrade net-misc/freerdp. | Oct 31, 2022 | Oct 21, 2021 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | Nov 12, 2021 | Oct 21, 2021 |
| Redhat_linux | — | Upgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-debuginfo | Nov 12, 2021 | Nov 11, 2021 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade libwinpr-devel | May 5, 2022 | Oct 21, 2021 |
| Suse | — | Upgrade libwinpr2Upgrade freerdp-serverUpgrade libuwac0-0Upgrade freerdp-waylandUpgrade uwac0-0-develUpgrade winpr2-develUpgrade freerdp-proxyUpgrade freerdp-develUpgrade freerdpUpgrade libfreerdp2 | Oct 26, 2022 | Oct 21, 2021 |
| Ubuntu | — | Upgrade libfreerdp-client2-2 | Nov 24, 2021 | Oct 21, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub