PT-2023-4655 · Freerdp+8 · Freerdp+8
Pwn2Carr
·
Publicado
2023-08-16
·
Atualizado
2025-02-15
·
CVE-2023-40589
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 2.11.0
FreeRDP versions prior to 3.0.0-beta3
Description
The issue is related to a Global-Buffer-Overflow in the
ncrush decompress function. Feeding crafted input into this function can trigger the overflow, which has only been shown to cause a crash. This can be exploited by a remote attacker to cause a denial of service.Recommendations
For versions prior to 2.11.0, upgrade to version 2.11.0 or later.
For versions prior to 3.0.0-beta3, upgrade to version 3.0.0-beta3 or later.
As a temporary workaround, consider disabling the
ncrush decompress function until a patch is available.Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Debian
Freerdp
Linuxmint
Red Hat
Suse
Ubuntu