CVE-2022-39283
published 2022-10-12CVE-2022-39283: FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.98%
58.4th percentile
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp2 2.8.1+dfsg1-1 (bookworm) | freerdp2 2.8.1+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freerdp | freerdp | < 2.8.1 | 2.8.1 |
| freerdp | freerdp | <= 2.8.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
FreeRDP up to 2.8.0 video Command out-of-bounds (GHSA-6cf9-3328-qrvh / EUVD-2022-41785)
vuldb·2026-06-29·CVSS 7.5
CVE-2022-39283 [HIGH] FreeRDP up to 2.8.0 video Command out-of-bounds (GHSA-6cf9-3328-qrvh / EUVD-2022-41785)
A vulnerability categorized as problematic has been discovered in FreeRDP up to 2.8.0. This impacts an unknown function of the component video Command Handler. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is handled as CVE-2022-39283. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
OSV
freerdp2 vulnerabilities
osv·2022-11-22·CVSS 7.5
CVE-2022-39282 [HIGH] freerdp2 vulnerabilities
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path checks. A
malicious server could use this issue to cause FreeRD
OSV
CVE-2022-39283: FreeRDP is a free remote desktop protocol library and clients
osv·2022-10-12·CVSS 7.5
CVE-2022-39283 [HIGH] CVE-2022-39283: FreeRDP is a free remote desktop protocol library and clients
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2022-11-22·CVSS 3.5
CVE-2022-39316 [LOW] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path
Red Hat
freerdp: clients using the `/video` command line switch might read uninitialized data
vendor_redhat·2022-10-13·CVSS 5.9
CVE-2022-39283 [MEDIUM] CWE-125 freerdp: clients using the `/video` command line switch might read uninitialized data
freerdp: clients using the `/video` command line switch might read uninitialized data
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
A vulnerability was found in FreeRDP where all clients using the /video command line switch might read uninitialized data, decode it as audio/video and display the result, leading to information disclosure.
Statement: FreeRDP based server implementations are not affected.
Mitigation: Workaround: Do not use the /video switch
Package: freerd
Debian
CVE-2022-39283: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based...
vendor_debian·2022·CVSS 5.9
CVE-2022-39283 [MEDIUM] CVE-2022-39283: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based...
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
Scope: local
bookworm: resolved (fixed in 2.8.1+dfsg1-1)
bullseye: resolved (fixed in 2.3.0+dfsg1-2+deb11u2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvhhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://security.gentoo.org/glsa/202210-24https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvhhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2025/02/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://security.gentoo.org/glsa/202210-24
2022-10-12
Published