PT-2020-12508 · Freerdp+7 · Freerdp+7

Bmiklautz · Published 2016-04-08 · Updated 2023-10-24 · CVE-2020-11046

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions 1.0 through 2.0.0

Description The issue is related to a stream out-of-bounds seek in the update read synchronize function, which could lead to a later out-of-bounds read.

Recommendations For FreeRDP versions 1.0 through 2.0.0, update to version 2.0.0 or later to resolve the issue.

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

ALSA-2020:4647

ALT-PU-2016-1308

CESA-2020_4031

CESA-2020_4647

CVE-2020-11046

DLA-2356-1

DLA-3606-1

GHSA-HX48-WMMM-MR5Q

MGASA-2020-0297

RHSA-2020:4031

RHSA-2020:4647

RHSA-2020_4031

RHSA-2020_4647

RLSA-2020:4647

USN-4379-1

USN-4382-1

USN-4382-2

Affected Products

Alt Linux

Almalinux

Centos

Freerdp

Linuxmint

Red Hat

Rocky Linux

Ubuntu

References · 142

• https://github.com/FreeRDP/FreeRDP/commit/ed53cd148f43cbab905eaa0f5308c2bf3c48cc37 · Patch
• https://ubuntu.com/security/CVE-2018-1000852 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11522 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4647.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11047 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0297.html · Security Note
• https://ubuntu.com/security/CVE-2020-11042 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13397 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11046 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IGSY4CEBOH6TVJLIW53YL7YDGHY3RMPU · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0297 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2356-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4382-2 · Vendor Advisory