Lucene search

K
cvelistGitHub_MCVELIST:CVE-2023-40569
HistoryAug 31, 2023 - 9:41 p.m.

CVE-2023-40569 Out-Of-Bounds Write in FreeRDP

2023-08-3121:41:12
CWE-787
GitHub_M
www.cve.org
2
cve-2023-40569
out-of-bounds write
freerdp
remote desktop protocol
apache license
progressive_decompress function
upgrade.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

46.0%

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the progressive_decompress function. This issue is likely down to incorrect calculations of the nXSrc and nYSrc variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "FreeRDP",
    "product": "FreeRDP",
    "versions": [
      {
        "version": "< 2.11.0",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0-beta1, < 3.0.0-beta3",
        "status": "affected"
      }
    ]
  }
]

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

46.0%