Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-63117 →
DEBIAN-CVE-2026-63117
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo bs operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org