CVE-2020-4031
published 2020-06-22CVE-2020-4031: In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.81%
76.1th percentile
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | freerdp2 | < freerdp2 2.1.2+dfsg1-1 (bookworm) | freerdp2 2.1.2+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freerdp | freerdp | < 2.1.2 | 2.1.2 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2020-09-01
CVE-2020-11095 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled certain memory
operations. A remote attacker could use this issue to cause FreeRDP to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
freerdp: use-after-free in gdi_SelectObject
vendor_redhat·2020-06-22·CVSS 3.5
CVE-2020-4031 [LOW] CWE-416 freerdp: use-after-free in gdi_SelectObject
freerdp: use-after-free in gdi_SelectObject
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
Statement: Although the vulnerable code could have been in versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, the build configuration disables the shadow-server functionality and thus the vulnerable code is not shipped. Therefore, versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8 are not affected. The version of freerdp shipped with Red Hat Enterprise Linux 6 does not contain the vulnerable code in the first place.
Package: freerdp (Red Hat Enterprise Linux 6) - Not affected
Package: freerdp (Red Hat Enterprise Linux 7
Debian
CVE-2020-4031: freerdp2 - In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. ...
vendor_debian·2020·CVSS 3.5
CVE-2020-4031 [LOW] CVE-2020-4031: freerdp2 - In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. ...
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
Scope: local
bookworm: resolved (fixed in 2.1.2+dfsg1-1)
bullseye: resolved (fixed in 2.1.2+dfsg1-1)
OSV
CVE-2020-4031: In FreeRDP before version 2
osv·2020-06-22·CVSS 7.5
CVE-2020-4031 [HIGH] CVE-2020-4031: In FreeRDP before version 2
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [fedora-all]
bugzilla·2020-07-08·CVSS 3.5
CVE-2020-4031 [LOW] CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [fedora-all]
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
Bugzilla
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
bugzilla·2020-07-08·CVSS 3.5
CVE-2020-4031 [LOW] CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
References:
http://www.freerdp.com/2020/06/22/2_1_2-released
https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g
Discussion:
Created freerdp tracking bugs for this issue:
Affects: epel-all [bug 1854891]
Affects: fedora-all [bug 1854890]
---
Going off of the code in the linked commit, there's a double-free possible in server/shadow/shadow_server.c's shadow_server_start() routine which, according to the upstream advisory, affects f
Bugzilla
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [epel-all]
bugzilla·2020-07-08·CVSS 3.5
CVE-2020-4031 [LOW] CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [epel-all]
CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora
Bugzilla
CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
bugzilla·2020-05-15·CVSS 2.2
CVE-2020-11526 [LOW] CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
CVE-2020-11526 freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
A vulnerability was found in FreeRDP after 1.1 and before 2.0.0, there is a Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
Upstream Reference:
https://pub.freerdp.com/cve/CVE-2020-11526/
Upstream Commit:
https://github.com/FreeRDP/FreeRDP/commit/192856cb59974ee4d7d3e72cbeafa676aa7565cf
Discussion:
Created freerdp tracking bugs for this issue:
Affects: epel-all [bug 1836252]
Affects: fedora-all [bug 1836251]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
---
This bug is now closed. Further updates for ind
Bugzilla
CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
bugzilla·2020-05-15·CVSS 2.2
CVE-2020-11525 [LOW] CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
CVE-2020-11525 freerdp: out-of-bounds read in bitmap.c
A vulnerability was found in FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read in bitmap.c.
Upstream Reference:
https://pub.freerdp.com/cve/CVE-2020-11525/
Upstream Commit:
https://github.com/FreeRDP/FreeRDP/commit/0b6b92a25a77d533b8a92d6acc840a81e103684e
Discussion:
Created freerdp tracking bugs for this issue:
Affects: epel-all [bug 1836241]
Affects: fedora-all [bug 1836240]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-11525
---
This issue h
Bugzilla
CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
bugzilla·2020-05-15·CVSS 6.5
CVE-2020-11522 [MEDIUM] CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
CVE-2020-11522 freerdp: out-of-bounds read in gdi.c
A vulnerability was found in FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read in gdi.c.
Upstream Reference:
https://pub.freerdp.com/cve/CVE-2020-11522/
Upstream Commit:
https://github.com/FreeRDP/FreeRDP/commit/907640a924fa7a9a99c80a48ac225e9d8e41548b
Discussion:
Created freerdp tracking bugs for this issue:
Affects: epel-all [bug 1836225]
Affects: fedora-all [bug 1836224]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-11522
---
This issue has bee
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlhttp://www.freerdp.com/2020/06/22/2_1_2-releasedhttps://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74ghttps://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/https://usn.ubuntu.com/4481-1/http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlhttp://www.freerdp.com/2020/06/22/2_1_2-releasedhttps://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74ghttps://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/https://usn.ubuntu.com/4481-1/
2020-06-22
Published