Search CVE reports
21 – 30 of 217 results
Some fixes available 2 of 8
FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write,...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER)...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |
Some fixes available 2 of 8
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freerdp | Not in release | Not in release | Not in release | — | Needs evaluation |
| freerdp2 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| freerdp3 | Fixed | Fixed | Not in release | — | — |