CVE-2022-39283

2022-10-1200:00:00

ubuntu.com

freerdp

video command

uninitialized data

audio/video

patch

version 2.8.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

57.4%

JSON

FreeRDP is a free remote desktop protocol library and clients. All FreeRDP
based clients when using the /video command line switch might read
uninitialized data, decode it as audio/video and display the result.
FreeRDP based server implementations are not affected. This issue has been
patched in version 2.8.1. If you cannot upgrade do not use the /video
switch.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021659>

Notes

Author	Note
mdeslaur	malicious server could read uninitialized data from client

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfreerdp< anyUNKNOWN
ubuntu16.04noarchfreerdp< anyUNKNOWN
ubuntu18.04noarchfreerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.4UNKNOWN
ubuntu20.04noarchfreerdp2< 2.2.0+dfsg1-0ubuntu0.20.04.4UNKNOWN
ubuntu22.04noarchfreerdp2< 2.6.1+dfsg1-3ubuntu2.3UNKNOWN
ubuntu22.10noarchfreerdp2< 2.8.1+dfsg1-0ubuntu1UNKNOWN
ubuntu23.04noarchfreerdp2< 2.8.1+dfsg1-0ubuntu1UNKNOWN
ubuntu23.10noarchfreerdp2< 2.8.1+dfsg1-0ubuntu1UNKNOWN
ubuntu24.04noarchfreerdp2< 2.8.1+dfsg1-0ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	freerdp	< any	UNKNOWN
ubuntu	16.04	noarch	freerdp	< any	UNKNOWN
ubuntu	18.04	noarch	freerdp2	< 2.2.0+dfsg1-0ubuntu0.18.04.4	UNKNOWN
ubuntu	20.04	noarch	freerdp2	< 2.2.0+dfsg1-0ubuntu0.20.04.4	UNKNOWN
ubuntu	22.04	noarch	freerdp2	< 2.6.1+dfsg1-3ubuntu2.3	UNKNOWN
ubuntu	22.10	noarch	freerdp2	< 2.8.1+dfsg1-0ubuntu1	UNKNOWN
ubuntu	23.04	noarch	freerdp2	< 2.8.1+dfsg1-0ubuntu1	UNKNOWN
ubuntu	23.10	noarch	freerdp2	< 2.8.1+dfsg1-0ubuntu1	UNKNOWN
ubuntu	24.04	noarch	freerdp2	< 2.8.1+dfsg1-0ubuntu1	UNKNOWN