CVE-2022-39282
published 2022-10-12CVE-2022-39282: FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.83%
53.4th percentile
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp2 2.8.1+dfsg1-1 (bookworm) | freerdp2 2.8.1+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freerdp | freerdp | < 2.8.1 | 2.8.1 |
| freerdp | freerdp | <= 2.8.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian3.5LOW
vendor_redhat3.5LOW
vendor_ubuntu3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FreeRDP up to 2.8.0 parallel Command uninitialized resource (GHSA-c45q-wcpg-mxjq / EUVD-2022-41784)
vuldb·2026-06-29·CVSS 7.5
CVE-2022-39282 [HIGH] FreeRDP up to 2.8.0 parallel Command uninitialized resource (GHSA-c45q-wcpg-mxjq / EUVD-2022-41784)
A vulnerability was found in FreeRDP up to 2.8.0. It has been rated as problematic. This affects an unknown function of the component parallel Command Handler. Performing a manipulation results in uninitialized resource.
This vulnerability is known as CVE-2022-39282. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
OSV
freerdp2 vulnerabilities
osv·2022-11-22·CVSS 7.5
CVE-2022-39282 [HIGH] freerdp2 vulnerabilities
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path checks. A
malicious server could use this issue to cause FreeRD
OSV
CVE-2022-39282: FreeRDP is a free remote desktop protocol library and clients
osv·2022-10-12·CVSS 7.5
CVE-2022-39282 [HIGH] CVE-2022-39282: FreeRDP is a free remote desktop protocol library and clients
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2022-11-22·CVSS 3.5
CVE-2022-39316 [LOW] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path
Red Hat
freerdp: clients using `/parallel` command line switch might read uninitialized data
vendor_redhat·2022-10-13·CVSS 3.5
CVE-2022-39282 [LOW] CWE-908 freerdp: clients using `/parallel` command line switch might read uninitialized data
freerdp: clients using `/parallel` command line switch might read uninitialized data
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
A vulnerability was found in FreeRDP where clients on UNIX systems using /parallel command line switch might read uninitialized data and send it to the client's server. The vulnerability allows a remote attacker to gain access to sensitive information.
Statemen
Debian
CVE-2022-39282: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based cli...
vendor_debian·2022·CVSS 3.5
CVE-2022-39282 [LOW] CVE-2022-39282: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. FreeRDP based cli...
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
Scope: local
bookworm: resolved (fixed in 2.8.1+dfsg1-1)
bullseye: resolved (fixed in 2.3.0+dfsg1-2+deb11u2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjqhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://security.gentoo.org/glsa/202210-24https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjqhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2025/02/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://security.gentoo.org/glsa/202210-24
2022-10-12
Published