VulnerabilityModified

CVE-2020-11089

In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write).

MEDIUM 5.5EPSS 1.15%

Does this matter?

Lower severity and a low EPSS score (1.15%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
EPSS: 1.15% probability · 65th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: freerdp/freerdp · opensuse/leap · debian/debian linux
Source: security-advisories@github.com

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/6b485b146a1b9d6ce72dfd7b5f36456c166e7a16Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/795842f4096501fcefc1a7f535ccc8132feb31d7Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hfc7-c5gv-8c2hThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/6b485b146a1b9d6ce72dfd7b5f36456c166e7a16Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/795842f4096501fcefc1a7f535ccc8132feb31d7Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hfc7-c5gv-8c2hThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.