This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-11042 →

DEBIAN-CVE-2020-11042

In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of...

Original description

The description as published by the source.

In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freerdp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1+dfsg1-1"}]}]

References

advisory security-tracker.debian.org