CVE-2022-39318

2022-11-1700:00:00

ubuntu.com

freerdp

remote desktop

input validation

urbdrc

security fix

upgrade

usb redirection

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

51.1%

JSON

FreeRDP is a free remote desktop protocol library and clients. Affected
versions of FreeRDP are missing input validation in urbdrc channel. A
malicious server can trick a FreeRDP based client to crash with division by
zero. This issue has been addressed in version 2.9.0. All users are advised
to upgrade. Users unable to upgrade should not use the /usb redirection
switch.

Notes

Author	Note
mdeslaur	malicious server could cause client to crash

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfreerdp< anyUNKNOWN
ubuntu16.04noarchfreerdp< anyUNKNOWN
ubuntu18.04noarchfreerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.4UNKNOWN
ubuntu20.04noarchfreerdp2< 2.2.0+dfsg1-0ubuntu0.20.04.4UNKNOWN
ubuntu22.04noarchfreerdp2< 2.6.1+dfsg1-3ubuntu2.3UNKNOWN
ubuntu22.10noarchfreerdp2< 2.8.1+dfsg1-0ubuntu1.1UNKNOWN
ubuntu23.04noarchfreerdp2< 2.8.1+dfsg1-1ubuntu1UNKNOWN
ubuntu23.10noarchfreerdp2< 2.8.1+dfsg1-1ubuntu1UNKNOWN
ubuntu24.04noarchfreerdp2< 2.8.1+dfsg1-1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	freerdp	< any	UNKNOWN
ubuntu	16.04	noarch	freerdp	< any	UNKNOWN
ubuntu	18.04	noarch	freerdp2	< 2.2.0+dfsg1-0ubuntu0.18.04.4	UNKNOWN
ubuntu	20.04	noarch	freerdp2	< 2.2.0+dfsg1-0ubuntu0.20.04.4	UNKNOWN
ubuntu	22.04	noarch	freerdp2	< 2.6.1+dfsg1-3ubuntu2.3	UNKNOWN
ubuntu	22.10	noarch	freerdp2	< 2.8.1+dfsg1-0ubuntu1.1	UNKNOWN
ubuntu	23.04	noarch	freerdp2	< 2.8.1+dfsg1-1ubuntu1	UNKNOWN
ubuntu	23.10	noarch	freerdp2	< 2.8.1+dfsg1-1ubuntu1	UNKNOWN
ubuntu	24.04	noarch	freerdp2	< 2.8.1+dfsg1-1ubuntu1	UNKNOWN