Invalid offset validation leading to Out Of Bound Write in FreeRDP
Summary
Invalid offset validation leading to Out Of Bound Write in FreeRDP
Original description
The description as published by the source.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values rect->left and rect->top are exactly equal to surface->width and surface->height. eg. rect->left == surface->width && rect->top == surface->height. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-39352 freerdp2 Fixed in: 2.3.0+dfsg1-2+deb11u2
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- web github.com
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org