CVE-2020-15103
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel.
Does this matter?
Lower severity and a low EPSS score (1.47%). Track it; it rarely justifies an emergency change on its own.
Description
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
- CVSS 3.1
- 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-680, CWE-190
- Affected
- freerdp/freerdp · fedoraproject/fedora · opensuse/leap · canonical/ubuntu linux · debian/debian linux
- Source
- security-advisories@github.com
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00010.htmlMailing List, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/blob/616af2d5b86dc24c7b3e89870dbcffd841d9a535/ChangeLog#L4Release Notes, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/pull/6382Patch, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
- https://usn.ubuntu.com/4481-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00010.htmlMailing List, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/blob/616af2d5b86dc24c7b3e89870dbcffd841d9a535/ChangeLog#L4Release Notes, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/pull/6382Patch, Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
- https://usn.ubuntu.com/4481-1/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.