FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability.(CVE-2024-22211)

Tenable has extracted the preceding description block directly from the EulerOS freerdp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset (CVE-2024-22211)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with     default compilation flags). When an insufficient blockLen is provided, and proper length validation is not     performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-39350)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2537 advisory.

    2024-06-06: CVE-2024-32660 was added to this advisory.

    FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

    Integer overflow & OutOfBound Write in clear_decompress_residual_data

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32039)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

    OutOfBound Read in zgfx_decompress_segment

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32041)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

    OutOfBound Read in interleaved_decompress

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32460)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6749-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0649-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0648-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f294ddb7fb advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-01689e51e5 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202965	EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2024-2027)	Nessus	Huawei Local Security Checks	critical
199366	RHEL 8 : freerdp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
197113	Amazon Linux 2 : freerdp (ALAS-2024-2537)	Nessus	Amazon Linux Local Security Checks	critical
193871	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : FreeRDP vulnerabilities (USN-6749-1)	Nessus	Ubuntu Local Security Checks	critical
191134	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : freerdp (SUSE-SU-2024:0649-1)	Nessus	SuSE Local Security Checks	critical
191132	SUSE SLED12 / SLES12 Security Update : freerdp (SUSE-SU-2024:0648-1)	Nessus	SuSE Local Security Checks	critical
190643	Fedora 38 : freerdp (2024-f294ddb7fb)	Nessus	Fedora Local Security Checks	critical
190637	Fedora 39 : freerdp (2024-01689e51e5)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-22211

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical