CVE-2020-11044 — Double Free in Freerdp

CWE-415 — Double FreeCWE-672 — Operation on a Resource after Expiration or Release10 documents7 sources
Severity
2.2LOWNVD
EPSS
0.1%
top 68.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FreerdpCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedMay 7
Latest updateJun 1

Description

In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:LExploitability: 0.7 | Impact: 1.4

Affected Packages2 packages

▶NVDfreerdp/freerdp< 2.0.0
▶CVEListV5freerdp/freerdp> 1.2, < 2.0.0

Also affects: Debian Linux 10.0, Ubuntu Linux 18.04, 19.10, 20.04

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
CVEList
Double Free in FreeRDP↗2020-05-07
▶
OSV
CVE-2020-11044: In FreeRDP greater than 1↗2020-05-07
▶

📋Vendor Advisories

3
Ubuntu
FreeRDP vulnerabilities↗2020-06-01
▶
Red Hat
freerdp: double free in update_read_cache_bitmap_v3_order function↗2020-03-31
▶
Debian
CVE-2020-11044: freerdp2 - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache...↗2020
▶

💬Community

4
Bugzilla
CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function↗2020-05-13
▶
Bugzilla
CVE-2020-11044 freerdp1.2: freerdp: double free in update_read_cache_bitmap_v3_order function [fedora-all]↗2020-05-13
▶
Bugzilla
CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function [epel-all]↗2020-05-13
▶
Bugzilla
CVE-2020-11044 freerdp: double free in update_read_cache_bitmap_v3_order function [fedora-all]↗2020-05-13
▶
CVE-2020-11044 — Double Free in Freerdp | cvebase