CVE-2020-11043

In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfxprocessmessagetileset. Invalid data fed to RFX decoder results in garbage on screen as colors. This has been patched in 2.1.0. Mitigation To mitigate this flaw, do not use /rfx, /gfx or /network:auto command line options...

CVE-2020-11038

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the serve...

CVE-2020-11018

In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0...

CVE-2020-11019

In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. Mitigation This flaw can be mitigated by not...

CVE-2020-11017

In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0. Mitigation Disable clipboard functionality in the freerdp server settings...

EulerOS 2.0 SP2 : freerdp (EulerOS-SA-2020-1678)

According to the version of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in updatereadsynchronize that could lead to a later out-of-bounds...

Huawei EulerOS: Security Advisory for freerdp (EulerOS-SA-2020-1678)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeRDP < 2.1.0 Multiple Vulnerabilities

FreeRDP is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200609)

Security Fixes : - freerdp: Out-of-bounds write in cryptorsacommon in libfreerdp/crypto/crypto.c CVE-2020-13398 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid137293; scriptversion"1.4";...

Scientific Linux Security Update : freerdp on SL6.x i386/x86_64 (20200609)

Security Fixes : - freerdp: Out-of-bounds write in cryptorsacommon in libfreerdp/crypto/crypto.c CVE-2020-13398 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid137292; scriptversion"1.4";...

FreeBSD : FreeRDP -- multiple vulnerabilities (669f3fe8-a07a-11ea-b83e-f0def1f5c5a2)

The FreeRDP changelog reports 14 CVEs addressed after 2.0.0-rc4 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c

An issue was found in freerdp's libfreerdp/crypto/crypto.c, in versions before 2.1.1, where buffer access with an incorrect length value, leads to an out-of-bounds write. This flaw allows a remote, unauthenticated, attacker running an RDP server, or a local attacker, using a specially crafted...

freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c

An issue was found in freerdp's libfreerdp/crypto/crypto.c, in versions before 2.1.1, where buffer access with an incorrect length value, leads to an out-of-bounds write. This flaw allows a remote, unauthenticated, attacker running an RDP server, or a local attacker, using a specially crafted...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Oracle Linux 8 : freerdp (ELSA-2020-2336)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2336 advisory. - CVE-2020-11521: Fix out-of-bounds write in planar.c 1837632 - CVE-2020-11523: Fix integer overflow in region.c 1837633 Tenable has extracted the...

RHEL 8 : freerdp (RHSA-2020:2415)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2415 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP server...

Oracle Linux 8 : freerdp (ELSA-2020-2407)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2407 advisory. 2:2.0.0-46.rc4.2 - CVE-2020-13398: Fix out-of-bounds write in crypto.c 1841978 Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 6 : freerdp (ELSA-2020-2406)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2406 advisory. 1.0.2-7 - CVE-2020-13398: Fix out-of-bounds write in crypto.c 1841980 Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 8 : freerdp (RHSA-2020:2417)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2417 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP server...