PT-2020-13519 · Freerdp+8 · Freerdp+8

Published 2020-05-20 · Updated 2024-06-15 · CVE-2020-13397

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.1.1

Description An out-of-bounds read issue has been detected in the security fips decrypt function in libfreerdp/core/security.c due to an uninitialized value. This issue affects the security of the software.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the security fips decrypt function in libfreerdp/core/security.c until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2020:4647

ALT-PU-2020-1985

ALT-PU-2020-2000

CESA-2020_4031

CESA-2020_4647

CVE-2020-13397

DLA-2356-1

DLA-3606-1

MGASA-2020-0297

OPENSUSE-SU-2020:1090-1

OPENSUSE-SU-2020_1090-1

OPENSUSE-SU-2024:10768-1

RHSA-2020:4031

RHSA-2020:4647

RHSA-2020_4031

RHSA-2020_4647

RLSA-2020:4647

SUSE-SU-2020:2032-1

SUSE-SU-2020:2068-1

SUSE-SU-2020:2272-1

USN-4379-1

USN-4382-1

USN-4382-2

Affected Products

Alt Linux

Almalinux

Centos

Freerdp

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 236

• https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2020:2032-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11521 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4647.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0297 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2272-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17177 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4647 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000852 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4382-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3606-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11045 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13396 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0297.html · Security Note