CVE-2020-11042 — Out-of-bounds Read in Freerdp
Severity
5.9MEDIUMNVD
CNA5.5
EPSS
0.1%
top 68.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 7
Latest updateNov 26
Description
In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:HExploitability: 0.7 | Impact: 5.2
Affected Packages2 packages
Also affects: Debian Linux 10.0, 9.0, Ubuntu Linux 16.04, 18.04, 19.10, 20.04
Patches
🔴Vulnerability Details
2📋Vendor Advisories
5Debian▶
CVE-2020-11042: freerdp2 - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in ...↗2020