Red Hat Security Advisory

RHSA-2024:9092

freerdp security update

Released 2024-11-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) freerdp-devel-2:2.11.7-1.el9, libwinpr-devel-2:2.11.7-1.el9
Red Hat Enterprise Linux AppStream (v. 9) freerdp-2:2.11.7-1.el9, freerdp-libs-2:2.11.7-1.el9, libwinpr-2:2.11.7-1.el9

Fixes 12 records

TI-2024-14803 CVE-2024-22211

FreeRDP integer Overflow leading to Heap Overflow

HIGH 75

FreeRDP is a set of free and open source remote desktop protocol library and clients.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01076 Published 2024-01-19 Partial fix · 2.11.5, 3.2.0 CWE-122

TI-2024-21354 CVE-2024-32459

FreeRDP Out-Of-Bounds Read in ncrush_decompress

MEDIUM 55

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0372 Published 2024-04-22 Partial fix · 2.11.6 CWE-125

TI-2024-21353 CVE-2024-32458

FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

MEDIUM 53

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01941 Published 2024-04-22 Partial fix · 2.11.6 CWE-125

TI-2024-21132 CVE-2024-32041

FreeRDP OutOfBound Read in zgfx_decompress_segment

MEDIUM 53

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01934 Published 2024-04-22 Partial fix · 2.11.6 CWE-125

TI-2024-21539 CVE-2024-32658

FreeRDP ExtractRunLengthRegular* out of bound read

MEDIUM 52

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01358 Published 2024-04-23 Partial fix · 3.5.1 CWE-125

TI-2024-21540 CVE-2024-32659

freerdp_image_copy out of bound read

MEDIUM 51

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01183 Published 2024-04-23 Partial fix · 3.5.1 CWE-125

TI-2024-21543 CVE-2024-32662

FreeRDP rdp_redirection_read_base64_wchar out of bound read

MEDIUM 49

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2024-04-23 Partial fix · 3.5.1 CWE-125

TI-2024-21130 CVE-2024-32039

FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data

MEDIUM 47

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02275 Published 2024-04-22 Partial fix · 2.11.6 CWE-190

TI-2024-21355 CVE-2024-32460

FreeRDP Out-Of-Bounds Read in interleaved_decompress

MEDIUM 46

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01907 Published 2024-04-22 Partial fix · 2.11.6 CWE-125

TI-2024-21131 CVE-2024-32040

FreeRDP vulnerable to integer underflow in nsc_rle_decode

MEDIUM 46

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01907 Published 2024-04-22 Partial fix · 2.11.6 CWE-191

TI-2024-21542 CVE-2024-32661

FreeRDP rdp_write_logon_info_v1 NULL access

MEDIUM 41

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01214 Published 2024-04-23 Partial fix · 3.5.1 CWE-476

TI-2024-21541 CVE-2024-32660

FreeRDP zgfx_decompress out of memory vulnerability

MEDIUM 41

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01168 Published 2024-04-23 Partial fix · 3.5.1 CWE-770