CVE-2020-4032

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html

http://www.freerdp.com/2020/06/22/2_1_2-released

https://github.com/FreeRDP/FreeRDP/commit/e7bffa64ef5ed70bac94f823e2b95262642f5296

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3898-mc89-x2vc

https://lists.fedoraproject.org/archives/list/[email protected]/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/

https://lists.fedoraproject.org/archives/list/[email protected]/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/

https://usn.ubuntu.com/4481-1/

Details

Source: MITRE

Published: 2020-06-22

Updated: 2020-09-08

Type: CWE-681

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 2.8

Severity: MEDIUM

Tenable Plugins

View all (4 total)

IDNameProductFamilySeverity
140179Ubuntu 18.04 LTS / 20.04 : FreeRDP vulnerabilities (USN-4481-1)NessusUbuntu Local Security Checks
medium
139263Fedora 31 : 2:freerdp (2020-a3432485db)NessusFedora Local Security Checks
medium
139103Fedora 32 : 2:freerdp (2020-8d5f86e29a)NessusFedora Local Security Checks
medium
139018openSUSE Security Update : freerdp (openSUSE-2020-1090)NessusSuSE Local Security Checks
high