PT-2020-12507 · Freerdp+7 · Freerdp+7

Bmiklautz · Published 2016-04-08 · Updated 2023-10-24 · CVE-2020-11045

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions FreeRDP versions 1.0 through 2.0.0

Description The issue is related to an out-of-bound read in the update read bitmap data function, which allows client memory to be read into an image buffer. The result of this action is displayed on the screen as color.

Recommendations For FreeRDP versions 1.0 through 2.0.0, consider updating to version 2.0.0 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2020:4647

ALT-PU-2016-1308

CESA-2020_4031

CESA-2020_4647

CVE-2020-11045

DLA-2356-1

DLA-3606-1

GHSA-3X39-248Q-F4Q6

MGASA-2020-0297

OESA-2021-1008

RHSA-2020:4031

RHSA-2020:4647

RHSA-2020_4031

RHSA-2020_4647

RLSA-2020:4647

USN-4379-1

USN-4382-1

USN-4382-2

Affected Products

Alt Linux

Almalinux

Centos

Freerdp

Linuxmint

Red Hat

Rocky Linux

Ubuntu

References · 154

• 🔥 https://github.com/FreeRDP/FreeRDP/issues/6005 · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/f8890a645c221823ac133dbf991f8a65ae50d637 · Patch
• https://ubuntu.com/security/CVE-2018-1000852 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11042 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11523 · Security Note
• https://linux.oracle.com/errata/ELSA-2020-4647.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11047 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0297.html · Security Note
• https://ubuntu.com/security/CVE-2020-11042 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11524 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11045 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13397 · Vendor Advisory