Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2023-39352

kritisch

CVE-2023-39352

freerdp: invalid offset validation leading to Out Of Bound Write

Veröffentlicht Geändert CWE 787
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), AlmaLinux (mittel), Oracle (mittel), Ubuntu (mittel).

Beschreibung

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
alma 9freerdp, freerdp-devel, freerdp-libs und 2 weitere2:2.11.2-1.el9
debian 10freerdp22.3.0+dfsg1-2+deb10u3
debian 11freerdp22.3.0+dfsg1-2+deb11u2
debian 12freerdp22.11.7+dfsg1-6~deb12u1
echofreerdp22.11.7+dfsg1-6~deb12u1
Oracle Linux 9freerdp, freerdp-devel, freerdp-libs und 2 weitere2:2.11.2-1.el9
rapidfort debian 12freerdp20:2.11.7+dfsg1-6~deb12u1
rapidfort debian 13freerdp20:2.11.7+dfsg1-6~deb12u1
rapidfort Oracle Linux 9freerdp, freerdp-libs, libwinpr2:2.11.2-1.el9
Red Hatfreerdp, freerdp-devel, freerdp-libs und 3 weiterekein Fix angegeben
ubuntu 18.04-ESMfreerdp22.2.0+dfsg1-0ubuntu0.18.04.4+esm2
ubuntu 20.04freerdp22.2.0+dfsg1-0ubuntu0.20.04.6
Alle 31 Einträge aus 16 Quellen zeigen
QuellePaketBehoben in
alma 9freerdp2:2.11.2-1.el9
alma 9freerdp-devel2:2.11.2-1.el9
alma 9freerdp-libs2:2.11.2-1.el9
alma 9libwinpr2:2.11.2-1.el9
alma 9libwinpr-devel2:2.11.2-1.el9
debian 10freerdp22.3.0+dfsg1-2+deb10u3
debian 11freerdp22.3.0+dfsg1-2+deb11u2
debian 12freerdp22.11.7+dfsg1-6~deb12u1
echofreerdp22.11.7+dfsg1-6~deb12u1
Oracle Linux 9freerdp2:2.11.2-1.el9
Oracle Linux 9freerdp-devel2:2.11.2-1.el9
Oracle Linux 9freerdp-libs2:2.11.2-1.el9
Oracle Linux 9libwinpr2:2.11.2-1.el9
Oracle Linux 9libwinpr-devel2:2.11.2-1.el9
rapidfort debian 12freerdp20:2.11.7+dfsg1-6~deb12u1
rapidfort debian 13freerdp20:2.11.7+dfsg1-6~deb12u1
rapidfort Oracle Linux 9freerdp2:2.11.2-1.el9
rapidfort Oracle Linux 9freerdp-libs2:2.11.2-1.el9
rapidfort Oracle Linux 9libwinpr2:2.11.2-1.el9
Red Hatfreerdpkein Fix angegeben
Red Hatfreerdp-develkein Fix angegeben
Red Hatfreerdp-libskein Fix angegeben
Red Hatfreerdp-pluginskein Fix angegeben
Red Hatlibwinprkein Fix angegeben
Red Hatlibwinpr-develkein Fix angegeben
ubuntu 18.04-ESMfreerdp22.2.0+dfsg1-0ubuntu0.18.04.4+esm2
ubuntu 20.04freerdp22.2.0+dfsg1-0ubuntu0.20.04.6
ubuntu 20.04-ESMfreerdp22.2.0+dfsg1-0ubuntu0.20.04.6
ubuntu 22.04freerdp22.6.1+dfsg1-3ubuntu2.5
ubuntu 23.04freerdp22.10.0+dfsg1-1ubuntu0.3
ubuntu 23.10freerdp22.10.0+dfsg1-1.1ubuntu1.1

Referenzen

Alle 29 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.