Debian Freerdp2 vulnerabilities

CVE-2022-39316 [MEDIUM] CVE-2022-39316: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. In affected versi... FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade. Sco

CVE-2022-39318 [MEDIUM] CVE-2022-39318: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. Affected versions... FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirec

CVE-2020-11095 [LOW] CVE-2020-11095: freerdp2 - In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in acces... In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. Scope: local bookworm: resolved (fixed in 2.1.2+dfsg1-1) bullseye: resolved (fixed in 2.1.2+dfsg1-1)

CVE-2020-11097 [LOW] CVE-2020-11097: freerdp2 - In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in acces... In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2. Scope: local bookworm: resolved (fixed in 2.1.2+dfsg1-1) bullseye: resolved (fixed in 2.1.2+dfsg1-1)

CVE-2020-11086 [LOW] CVE-2020-11086: freerdp2 - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_re... In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11089 [LOW] CVE-2020-11089: freerdp2 - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (paralle... In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11088 [LOW] CVE-2020-11088: freerdp2 - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_re... In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11087 [LOW] CVE-2020-11087: freerdp2 - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_re... In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2022-39320 [MEDIUM] CVE-2022-39320: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. Affected versions... FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0

CVE-2020-13397 [MEDIUM] CVE-2020-13397: freerdp2 - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vul... An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2022-41877 [MEDIUM] CVE-2022-41877: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. Affected versions... FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrad

CVE-2022-39319 [MEDIUM] CVE-2022-39319: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. Affected versions... FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to u

CVE-2022-39317 [MEDIUM] CVE-2022-39317: freerdp2 - FreeRDP is a free remote desktop protocol library and clients. Affected versions... FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue. Scope: local

CVE-2020-4032 [LOW] CVE-2020-4032: freerdp2 - In FreeRDP before version 2.1.2, there is an integer casting vulnerability in up... In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2. Scope: local bookworm: resolved (fixed in 2.1.2+dfsg1-1) bullseye: resolved (fixed in 2.1.2+dfsg1-1)

CVE-2020-15103 [LOW] CVE-2020-15103: freerdp2 - In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missin... In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcp

CVE-2020-11085 [LOW] CVE-2020-11085: freerdp2 - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_l... In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11045 [LOW] CVE-2020-11045: freerdp2 - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in updat... In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11044 [LOW] CVE-2020-11044: freerdp2 - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache... In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2020-11049 [MEDIUM] CVE-2020-11049: freerdp2 - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client m... In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0. Scope: local bookworm: resolved (fixed in 2.1.1+dfsg1-1) bullseye: resolved (fixed in 2.1.1+dfsg1-1)

CVE-2026-29776 [LOW] CVE-2026-29776: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0... FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library This vulnerability is fixed in 3.24.0. Scope: local bookworm: open bullseye: open