CVE-2019-17177 — Missing Release of Memory after Effective Lifetime in Freerdp

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime9 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.9%
top 24.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Freerdp2FreerdpOpensuse Leap
Timeline
PublishedOct 4
Latest updateMay 24

Description

libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/freerdp2< freerdp2 2.0.0~git20190204.1.2693389a+dfsg1-2 (bookworm)
▶NVDfreerdp/freerdp1.0.2+2
▶NVDopensuse/leap15.0, 15.1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-phg4-6rh6-vr83: libfreerdp/codec/region↗2022-05-24
▶
OSV
CVE-2019-17177: libfreerdp/codec/region↗2019-10-04
▶

📋Vendor Advisories

3
Ubuntu
FreeRDP vulnerabilities↗2020-06-01
▶
Red Hat
freerdp: supplied realloc pointer leads to memory leak↗2019-10-04
▶
Debian
CVE-2019-17177: freerdp2 - libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-17177 freerdp: supplied realloc pointer leads to memory leak [epel-all]↗2020-02-11
▶
Bugzilla
CVE-2019-17177 freerdp: supplied realloc pointer leads to memory leak [fedora-all]↗2020-02-11
▶
Bugzilla
CVE-2019-17177 freerdp: supplied realloc pointer leads to memory leak↗2020-02-11
▶
CVE-2019-17177 — Freerdp vulnerability | cvebase