CVE-2023-39352
published 2023-08-31CVE-2023-39352: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.30%
67.1th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | freerdp2 | < freerdp2 2.11.7+dfsg1-6~deb12u1 (bookworm) | freerdp2 2.11.7+dfsg1-6~deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freerdp | freerdp | < 2.11.0 | 2.11.0 |
| freerdp | freerdp | — | — |
| freerdp | freerdp | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
freerdp2 vulnerabilities
osv·2023-12-07·CVSS 4.6
CVE-2022-41877 [MEDIUM] freerdp2 vulnerabilities
freerdp2 vulnerabilities
USN-6522-1 fixed several vulnerabilities in FreeRDP. This update provides
the corresponding update for Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that FreeRDP incorrectly handled drive redirection. If a
user were tricked into connection to a malicious server, a remote attacker
could use this issue to cause FreeRDP to crash, resulting in a denial of
service, or possibly obtain sensitive information. (CVE-2022-41877)
It was discovered that FreeRDP incorrectly handled certain surface updates.
A remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2023-39352, CVE-2023-39356)
OSV
freerdp2 vulnerabilities
osv·2023-11-29·CVSS 4.6
CVE-2022-41877 [MEDIUM] freerdp2 vulnerabilities
freerdp2 vulnerabilities
It was discovered that FreeRDP incorrectly handled drive redirection. If a
user were tricked into connection to a malicious server, a remote attacker
could use this issue to cause FreeRDP to crash, resulting in a denial of
service, or possibly obtain sensitive information. (CVE-2022-41877)
It was discovered that FreeRDP incorrectly handled certain surface updates.
A remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2023-39352, CVE-2023-39356)
OSV
CVE-2023-39352: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
osv·2023-08-31·CVSS 9.8
CVE-2023-39352 [CRITICAL] CVE-2023-39352: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2023-12-07·CVSS 4.6
CVE-2023-39352 [MEDIUM] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
USN-6522-1 fixed several vulnerabilities in FreeRDP. This update provides
the corresponding update for Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that FreeRDP incorrectly handled drive redirection. If a
user were tricked into connection to a malicious server, a remote attacker
could use this issue to cause FreeRDP to crash, resulting in a denial of
service, or possibly obtain sensitive information. (CVE-2022-41877)
It was discovered that FreeRDP incorrectly handled certain surface updates.
A remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2023-39352, CVE-2023-39356)
Instructions: In general
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2023-11-29·CVSS 4.6
CVE-2023-39352 [MEDIUM] FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP incorrectly handled drive redirection. If a
user were tricked into connection to a malicious server, a remote attacker
could use this issue to cause FreeRDP to crash, resulting in a denial of
service, or possibly obtain sensitive information. (CVE-2022-41877)
It was discovered that FreeRDP incorrectly handled certain surface updates.
A remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2023-39352, CVE-2023-39356)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
freerdp: invalid offset validation leading to Out Of Bound Write
vendor_redhat·2023-08-31·CVSS 5.3
CVE-2023-39352 [MEDIUM] CWE-787 freerdp: invalid offset validation leading to Out Of Bound Write
freerdp: invalid offset validation leading to Out Of Bound Write
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
A flaw was found in FreeRDP. An out-of-bounds write may occur when the values `rect->left` and `rect->top` are exactly equal to `surface->widt
Debian
CVE-2023-39352: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ...
vendor_debian·2023·CVSS 5.3
CVE-2023-39352 [MEDIUM] CVE-2023-39352: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released ...
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Scope: local
bookworm: resolved (fixed in 2.11.7+dfsg1-6~deb12u1)
bullseye: resolved (fixed in 2.3.0+dfsg1-2+deb11u2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvjhttps://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/https://security.gentoo.org/glsa/202401-16https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvjhttps://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlhttps://lists.debian.org/debian-lts-announce/2025/02/msg00016.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/https://security.gentoo.org/glsa/202401-16
2023-08-31
Published