CVE-2022-39283 — Out-of-bounds Read in Freerdp

CWE-125 — Out-of-bounds ReadCWE-908 — Use of Uninitialized Resource6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 42.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FreerdpDebian Freerdp2Fedoraproject Fedora
Timeline
PublishedOct 12
Latest updateNov 22

Description

FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDfreerdp/freerdp< 2.8.1
▶debiandebian/freerdp2< freerdp2 2.8.1+dfsg1-1 (bookworm)
▶CVEListV5freerdp/freerdp2.8.0

Also affects: Fedora 35, 36, 37

🔴Vulnerability Details

2
OSV
freerdp2 vulnerabilities↗2022-11-22
▶
OSV
CVE-2022-39283: FreeRDP is a free remote desktop protocol library and clients↗2022-10-12
▶

📋Vendor Advisories

3
Ubuntu
FreeRDP vulnerabilities↗2022-11-22
▶
Red Hat
freerdp: clients using the `/video` command line switch might read uninitialized data↗2022-10-13
▶
Debian
CVE-2022-39283: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based...↗2022
▶
CVE-2022-39283 — Out-of-bounds Read in Freerdp | cvebase