In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4481-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use     this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Bugfix and CVE release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freerdp fixes the following issues :

frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006) :

  - CVE-2020-11017: Fixed a double free which could have     denied the server's service.

  - CVE-2020-11018: Fixed an out of bounds read which a     malicious clients could have triggered.

  - CVE-2020-11019: Fixed an issue which could have led to     denial of service if logger was set to 'WLOG_TRACE'.

  - CVE-2020-11038: Fixed a buffer overflow when /video     redirection was used.

  - CVE-2020-11039: Fixed an issue which could have allowed     arbitrary memory read and write when USB redirection was     enabled.

  - CVE-2020-11040: Fixed an out of bounds data read in     clear_decompress_subcode_rlex.

  - CVE-2020-11041: Fixed an issue with the configuration     for sound backend which could have led to server's     denial of service.

  - CVE-2020-11043: Fixed an out of bounds read in     rfx_process_message_tileset.

  - CVE-2020-11085: Fixed an out of bounds read in     cliprdr_read_format_list.

  - CVE-2020-11086: Fixed an out of bounds read in     ntlm_read_ntlm_v2_client_challenge.

  - CVE-2020-11087: Fixed an out of bounds read in     ntlm_read_AuthenticateMessage.

  - CVE-2020-11088: Fixed an out of bounds read in     ntlm_read_NegotiateMessage.

  - CVE-2020-11089: Fixed an out of bounds read in irp     function family.

  - CVE-2020-11095: Fixed a global out of bounds read in     update_recv_primary_order.

  - CVE-2020-11096: Fixed a global out of bounds read in     update_read_cache_bitmap_v3_order.

  - CVE-2020-11097: Fixed an out of bounds read in     ntlm_av_pair_get.

  - CVE-2020-11098: Fixed an out of bounds read in     glyph_cache_put.

  - CVE-2020-11099: Fixed an out of bounds Read in     license_read_new_or_upgrade_license_packet.

  - CVE-2020-11521: Fixed an out of bounds write in planar.c     (bsc#1171443).

  - CVE-2020-11522: Fixed an out of bounds read in gdi.c     (bsc#1171444).

  - CVE-2020-11523: Fixed an integer overflow in region.c     (bsc#1171445).

  - CVE-2020-11524: Fixed an out of bounds write in     interleaved.c (bsc#1171446).

  - CVE-2020-11525: Fixed an out of bounds read in bitmap.c     (bsc#1171447).

  - CVE-2020-11526: Fixed an out of bounds read in     update_recv_secondary_order (bsc#1171674).

  - CVE-2020-13396: Fixed an Read in     ntlm_read_ChallengeMessage.

  - CVE-2020-13397: Fixed an out of bounds read in     security_fips_decrypt due to uninitialized value.

  - CVE-2020-13398: Fixed an out of bounds write in     crypto_rsa_common.

  - CVE-2020-4030: Fixed an out of bounds read in     `TrioParse`.

  - CVE-2020-4031: Fixed a use after free in     gdi_SelectObject.

  - CVE-2020-4032: Fixed an integer casting in     `update_recv_secondary_order`.

  - CVE-2020-4033: Fixed an out of bound read in     RLEDECOMPRESS.

  - Fixed an issue where freerdp failed with -fno-common     (bsc#1169748).

  - Fixed an issue where USB redirection with FreeRDP was     not working (bsc#1169679).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Severity
182754	Debian dla-3606 : freerdp2-dev - security update	Nessus	Debian Local Security Checks	critical
140179	Ubuntu 18.04 LTS / 20.04 LTS : FreeRDP vulnerabilities (USN-4481-1)	Nessus	Ubuntu Local Security Checks	medium
139263	Fedora 31 : 2:freerdp (2020-a3432485db)	Nessus	Fedora Local Security Checks	medium
139103	Fedora 32 : 2:freerdp (2020-8d5f86e29a)	Nessus	Fedora Local Security Checks	medium
139018	openSUSE Security Update : freerdp (openSUSE-2020-1090)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-4032

medium

Tenable Plugins

critical

medium

medium

medium

high