CVE-2022-39316
published 2022-11-16CVE-2022-39316: FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A…
PriorityP428medium5.7CVSS 3.1
AVNACLPRLUIRSUCNINAH
EPSS
0.97%
57.8th percentile
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp2 2.9.0+dfsg1-1 (bookworm) | freerdp2 2.9.0+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freerdp | freerdp | < 2.9.0 | 2.9.0 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian4.8MEDIUM
vendor_redhat4.8MEDIUM
vendor_ubuntu3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
freerdp2 vulnerabilities
osv·2022-11-22·CVSS 7.5
CVE-2022-39282 [HIGH] freerdp2 vulnerabilities
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path checks. A
malicious server could use this issue to cause FreeRD
OSV
CVE-2022-39316: FreeRDP is a free remote desktop protocol library and clients
osv·2022-11-16·CVSS 5.7
CVE-2022-39316 [MEDIUM] CVE-2022-39316: FreeRDP is a free remote desktop protocol library and clients
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2022-11-22·CVSS 3.5
CVE-2022-39316 [LOW] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
22.04 LTS. (CVE-2022-39282, CVE-2022-39283)
It was discovered that FreeRDP incorrectly handled certain data lenghts. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320)
It was discovered that FreeRDP incorrectly handled certain path
Red Hat
freerdp: out of bounds read in zgfx decoder
vendor_redhat·2022-11-16·CVSS 4.8
CVE-2022-39316 [MEDIUM] CWE-125 freerdp: out of bounds read in zgfx decoder
freerdp: out of bounds read in zgfx decoder
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service.
Package: freerdp (Red Hat Enterprise Linux 6) - Out of support scope
Package: freerdp (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2022-39316: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. In affected versi...
vendor_debian·2022·CVSS 4.8
CVE-2022-39316 [MEDIUM] CVE-2022-39316: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. In affected versi...
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
Scope: local
bookworm: resolved (fixed in 2.9.0+dfsg1-1)
bullseye: resolved (fixed in 2.3.0+dfsg1-2+deb11u2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrmhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/https://security.gentoo.org/glsa/202401-16https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrmhttps://lists.debian.org/debian-lts-announce/2023/11/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2025/02/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/https://security.gentoo.org/glsa/202401-16
2022-11-16
Published