Security update for freerdp (important)

An update that fixes 31 vulnerabilities is now available.

Description:

This update for freerdp fixes the following issues:

frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and
jsc#ECO-2006):

• CVE-2020-11017: Fixed a double free which could have denied the server’s
  service.
• CVE-2020-11018: Fixed an out of bounds read which a malicious clients
  could have triggered.
• CVE-2020-11019: Fixed an issue which could have led to denial of service
  if logger was set to “WLOG_TRACE”.
• CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.
• CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory
  read and write when USB redirection was enabled.
• CVE-2020-11040: Fixed an out of bounds data read in
  clear_decompress_subcode_rlex.
• CVE-2020-11041: Fixed an issue with the configuration for sound backend
  which could have led to server’s denial of service.
• CVE-2020-11043: Fixed an out of bounds read in
  rfx_process_message_tileset.
• CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.
• CVE-2020-11086: Fixed an out of bounds read in
  ntlm_read_ntlm_v2_client_challenge.
• CVE-2020-11087: Fixed an out of bounds read in
  ntlm_read_AuthenticateMessage.
• CVE-2020-11088: Fixed an out of bounds read in
  ntlm_read_NegotiateMessage.
• CVE-2020-11089: Fixed an out of bounds read in irp function family.
• CVE-2020-11095: Fixed a global out of bounds read in
  update_recv_primary_order.
• CVE-2020-11096: Fixed a global out of bounds read in
  update_read_cache_bitmap_v3_order.
• CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.
• CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.
• CVE-2020-11099: Fixed an out of bounds Read in
  license_read_new_or_upgrade_license_packet.
• CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).
• CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).
• CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).
• CVE-2020-11524: Fixed an out of bounds write in interleaved.c
  (bsc#1171446).
• CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).
• CVE-2020-11526: Fixed an out of bounds read in
  update_recv_secondary_order (bsc#1171674).
• CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.
• CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due
  to uninitialized value.
• CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.
• CVE-2020-4030: Fixed an out of bounds read in TrioParse.
• CVE-2020-4031: Fixed a use after free in gdi_SelectObject.
• CVE-2020-4032: Fixed an integer casting in update_recv_secondary_order.
• CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.
• Fixed an issue where freerdp failed with -fno-common (bsc#1169748).
• Fixed an issue where USB redirection with FreeRDP was not working
  (bsc#1169679).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.1:

  zypper in -t patch openSUSE-2020-1090=1