PT-2020-13520 · Freerdp+6 · Freerdp+6

Published 2020-05-20 · Updated 2024-06-15 · CVE-2020-13398

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.1.1

Description An out-of-bounds write issue has been detected in the crypto rsa common function in libfreerdp/crypto/crypto.c. This issue affects FreeRDP and is related to an out-of-bounds (OOB) write vulnerability.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the crypto rsa common function in libfreerdp/crypto/crypto.c until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-1985

ALT-PU-2020-2000

CESA-2020_2406

CESA-2020_2407

CVE-2020-13398

DLA-2356-1

DLA-3606-1

MGASA-2020-0297

OPENSUSE-SU-2020:1090-1

OPENSUSE-SU-2020_1090-1

OPENSUSE-SU-2024:10768-1

RHSA-2020:2405

RHSA-2020:2406

RHSA-2020:2407

RHSA-2020:2415

RHSA-2020:2417

RHSA-2020_2405

RHSA-2020_2406

RHSA-2020_2407

SUSE-SU-2020:2032-1

SUSE-SU-2020:2068-1

SUSE-SU-2020:2272-1

USN-4379-1

USN-4382-1

USN-4382-2

Affected Products

Alt Linux

Centos

Freerdp

Linuxmint

Red Hat

Suse

Ubuntu

References · 179

• https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc607655aadea · Patch
• https://osv.dev/vulnerability/SUSE-SU-2020:2032-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11521 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13398 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-2405.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0297 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2272-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000852 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4382-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3606-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11045 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0297.html · Security Note
• https://ubuntu.com/security/CVE-2020-13396 · Vendor Advisory