CVE-2020-15103

Name
CVE-2020-15103
Description
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
NVD Severity
low
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/FreeRDP/FreeRDP/pull/6382
Third Party Advisory https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9
Release Notes https://github.com/FreeRDP/FreeRDP/blob/616af2d5b86dc24c7b3e89870dbcffd841d9a535/ChangeLog#L4
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00010.html
Third Party Advisory https://usn.ubuntu.com/4481-1/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* freerdp >= None <= 2.1.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
freerdp2 edge-community 2.2.0-r0 None fixed
freerdp2 3.22-community 2.2.0-r0 None fixed
freerdp edge-community 2.2.0-r0 None fixed
freerdp edge-community 2.1.2-r0 None possibly vulnerable
freerdp edge-community 2.0.0_rc4-r0 None possibly vulnerable
freerdp edge-community 2.0.0-r1 None possibly vulnerable
freerdp edge-community 2.0.0-r0 None possibly vulnerable
freerdp 3.22-community 2.2.0-r0 None fixed
freerdp 3.22-community 2.1.2-r0 None possibly vulnerable
freerdp 3.22-community 2.0.0_rc4-r0 None possibly vulnerable
freerdp 3.22-community 2.0.0-r1 None possibly vulnerable
freerdp 3.22-community 2.0.0-r0 None possibly vulnerable
freerdp 3.21-community 2.2.0-r0 None fixed
freerdp 3.20-community 2.2.0-r0 None fixed
freerdp 3.19-community 2.2.0-r0 None fixed
freerdp 3.18-community 2.2.0-r0 None fixed
freerdp 3.17-community 2.2.0-r0 None fixed