TI-2017-02060 Aliases CVE-2017-2839 GHSA-ww79-66cx-mh7h

An exploitable denial of service vulnerability exists within the handling of challenge…

LOW 30Published 2018-04-24 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge packet can cause the program termination leading to a denial of service condition. An attacker can compromise the server or use man in the middle to trigger this vulnerability.

Why it matters now

EPSS 0.01554 75th percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FreeRDP	FreeRDP	2.0.0-beta1+android11 - Windows, OSX, Linux	—	No fix listed	CNA

FreeRDP VendorFreeRDP Affected 2.0.0-beta1+android11 - Windows, OSX, Linux Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:freerdp:freerdp:2.0.0:beta1::::::	2.0.0 beta1	Vulnerable	FreeRDP
cpe:2.3:o:debian:debian_linux:8.0:::::::*	8.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian

cpe:2.3:a:freerdp:freerdp:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·FreeRDP
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2018-04-24
FreeRDP — DSA-3923
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2017-02056 Out-of-bounds write in FreeRDPPriority LOW 38
- TI-2017-02055 Out-of-bounds write in FreeRDPPriority LOW 34
- TI-2017-02059 Integer overflow in FreeRDPPriority LOW 30
Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2017-2839
2026-10-03 Alias added: GHSA-ww79-66cx-mh7h

References

Advisory 2

TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1

See all 336 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences