Red Hat Security Advisory

RHSA-2024:2208

freerdp security update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) freerdp-2:2.11.2-1.el9, freerdp-libs-2:2.11.2-1.el9, libwinpr-2:2.11.2-1.el9
Red Hat Enterprise Linux CRB (v. 9) freerdp-devel-2:2.11.2-1.el9, libwinpr-devel-2:2.11.2-1.el9

Fixes 12 records

TI-2023-21368 CVE-2023-40569

Out-Of-Bounds Write in FreeRDP

MEDIUM 45

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01309 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-787

TI-2023-21367 CVE-2023-40567

Out-Of-Bounds Write in FreeRDP

MEDIUM 45

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01503 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-787

TI-2023-21059 CVE-2023-40186

IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP

MEDIUM 45

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01357 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-190

TI-2023-20491 CVE-2023-39352

Invalid offset validation leading to Out Of Bound Write in FreeRDP

MEDIUM 45

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01535 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-787

TI-2023-21054 CVE-2023-40181

Integer-Underflow leading to Out-Of-Bound Read in FreeRDP

MEDIUM 43

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01694 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-125

TI-2023-20495 CVE-2023-39356

Missing offset validation leading to Out-of-Bounds Read in FreeRDP

MEDIUM 43

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01809 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-125

TI-2023-21061 CVE-2023-40188

Out-Of-Bounds Read in FreeRDP

MEDIUM 42

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01476 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-125

TI-2023-20492 CVE-2023-39353

Missing offset validation leading to Out Of Bound Read in FreeRDP

MEDIUM 42

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01476 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-125

TI-2023-20493 CVE-2023-39354

FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data

LOW 36

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01576 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-125

TI-2023-20490 CVE-2023-39351

FreeRDP Null Pointer Dereference leading denial of service

LOW 36

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01564 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-476

TI-2023-20489 CVE-2023-39350

Incorrect offset calculation leading to denial of service in FreeRDP

LOW 36

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01639 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-191

TI-2023-21387 CVE-2023-40589

FreeRDP Global-Buffer-Overflow in ncrush_decompress

LOW 35

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01298 Published 2023-08-31 Partial fix · 2.11.0, 3.0.0-beta3 CWE-120