Red Hat Security Advisory

RHSA-2023:2326

freerdp security update

Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) freerdp-2:2.4.1-5.el9, freerdp-libs-2:2.4.1-5.el9, libwinpr-2:2.4.1-5.el9
Red Hat Enterprise Linux CRB (v. 9) freerdp-devel-2:2.4.1-5.el9, libwinpr-devel-2:2.4.1-5.el9

Fixes 9 records

TI-2022-18659 CVE-2022-39283

FreeRDP may read and display out of bounds data

LOW 36

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01383 Published 2022-10-12 Partial fix CWE-125

TI-2022-18658 CVE-2022-39282

RDP client: Read of uninitialized memory with parallel port redirection

LOW 35

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01102 Published 2022-10-12 Partial fix CWE-908

TI-2022-18722 CVE-2022-39347

Missing path sanitation with `drive` channel in FreeRDP

LOW 28

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00993 Published 2022-11-16 Partial fix · 2.9.0 CWE-22

TI-2022-18694 CVE-2022-39318

Division by zero in urbdrc channel in FreeRDP

LOW 28

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01048 Published 2022-11-16 Partial fix · 2.9.0 CWE-20

TI-2022-18692 CVE-2022-39316

Out of bound read in FreeRDP

LOW 28

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01063 Published 2022-11-16 Partial fix · 2.9.0 CWE-125

TI-2022-18696 CVE-2022-39320

Heap buffer overflow in urbdrc channel

LOW 26

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0074 Published 2022-11-16 Partial fix · 2.9.0 CWE-125

TI-2022-20218 CVE-2022-41877

Missing input length validation in `drive` channel in FreeRDP

LOW 23

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00803 Published 2022-11-16 Partial fix · 2.9.0 CWE-119

TI-2022-18695 CVE-2022-39319

Missing length validation in urbdrc channel in FreeRDP

LOW 23

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00767 Published 2022-11-16 Partial fix · 2.9.0 CWE-125

TI-2022-18693 CVE-2022-39317

Out of bounds read in zgfx decoder in FreeRDP

LOW 22

FreeRDP is a free remote desktop protocol library and clients.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00688 Published 2022-11-16 Partial fix · 2.9.0 CWE-125