PT-2020-5623 · Freerdp+8 · Freerdp+8

Lowakallabeth · Published 2020-06-22 · Updated 2024-06-15 · CVE-2020-4033

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.1.2

Description The issue is related to an out of bounds read in the RLEDECOMPRESS component of the FreeRDP implementation. This can be exploited by a remote attacker to gain access to confidential data and cause a denial of service. All FreeRDP based clients with sessions that have a color depth of less than 32 are affected.

Recommendations For versions prior to 2.1.2, update to version 2.1.2 to resolve the issue. As a temporary workaround, consider restricting the color depth of sessions to 32 or higher until the update can be applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2021:1849

ALT-PU-2020-2225

ALT-PU-2020-2232

BDU:2021-01323

CESA-2021_1849

CVE-2020-4033

DLA-3606-1

GHSA-7RHJ-856W-82P8

MGASA-2020-0297

OPENSUSE-SU-2020:1090-1

OPENSUSE-SU-2020_1090-1

OPENSUSE-SU-2024:10768-1

RHSA-2021:1849

RHSA-2021_1849

RLSA-2021:1849

SUSE-SU-2020:2032-1

SUSE-SU-2020:2068-1

SUSE-SU-2020:2272-1

USN-4481-1

Affected Products

Alt Linux

Almalinux

Centos

Freerdp

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 189

• https://github.com/FreeRDP/FreeRDP/commit/0a98c450c58ec150e44781c89aa6f8e7e0f571f5 · Patch
• https://ubuntu.com/security/CVE-2020-11095 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2068-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:1849 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-4033 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0297.html · Security Note
• https://ubuntu.com/security/CVE-2020-11097 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01323 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-4033 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:1849 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IGSY4CEBOH6TVJLIW53YL7YDGHY3RMPU · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0297 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1090-1 · Vendor Advisory