Red Hat Security Advisory

RHSA-2019:0697

freerdp security update

Released 2019-04-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) freerdp-1.0.2-15.el7_6.1, freerdp-libs-1.0.2-15.el7_6.1, freerdp-plugins-1.0.2-15.el7_6.1
Red Hat Enterprise Linux Client Optional (v. 7) freerdp-devel-1.0.2-15.el7_6.1
Red Hat Enterprise Linux Server (v. 7) freerdp-1.0.2-15.el7_6.1, freerdp-libs-1.0.2-15.el7_6.1, freerdp-libs-1.0.2-15.el7_6.1.ppc +1
Red Hat Enterprise Linux Server Optional (v. 7) freerdp-devel-1.0.2-15.el7_6.1, freerdp-devel-1.0.2-15.el7_6.1.ppc
Red Hat Enterprise Linux Workstation (v. 7) freerdp-1.0.2-15.el7_6.1, freerdp-libs-1.0.2-15.el7_6.1, freerdp-plugins-1.0.2-15.el7_6.1
Red Hat Enterprise Linux Workstation Optional (v. 7) freerdp-devel-1.0.2-15.el7_6.1
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) freerdp-1.0.2-15.el7_6.1, freerdp-libs-1.0.2-15.el7_6.1, freerdp-plugins-1.0.2-15.el7_6.1
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) freerdp-devel-1.0.2-15.el7_6.1

Fixes 3 records

TI-2018-06335 CVE-2018-8787 · GHSA-264x-4r27-x5m2

Integer overflow in Check Point Software Technologies Ltd. FreeRDP

MEDIUM 53

FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08357 Published 2018-11-29 Partial fix · 2.0.0-rc4 CWE-680

TI-2018-06334 CVE-2018-8786 · GHSA-2pjf-gmmm-fv82

Incorrect numeric conversion in Check Point Software Technologies Ltd. FreeRDP

MEDIUM 53

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code exec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08156 Published 2018-11-29 Partial fix · 2.0.0-rc4 CWE-680

TI-2018-06336 CVE-2018-8788 · GHSA-j2cm-xc9q-86w4

Out-of-bounds write in Check Point Software Technologies Ltd. FreeRDP

MEDIUM 52

FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.074 Published 2018-11-29 Partial fix · 2.0.0-rc4 CWE-787