CVE-2023-39356

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP),
released under the Apache license. In affected versions a missing offset
validation may lead to an Out Of Bound Read in the function
gdi_multi_opaque_rect. In particular there is no code to validate if the
value multi_opaque_rect->numRectangles is less than 45. Looping through
multi_opaque_rect->numRectangles without proper boundary checks can lead
to Out-of-Bounds Read errors which will likely lead to a crash. This issue
has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to
upgrade. There are no known workarounds for this vulnerability.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051638&gt;