Detections
Analytics

Alpine: multiple freerdp packages: security update to 2.11.5-r0

critical Tenable Self-Hosted Container Security Plugin ID 408354

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions
 an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects
 FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server
 could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out
 of bound read/write. Data extraction over network is not possible, the buffers are used to display an
 image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are
 no know workarounds for this vulnerability. (CVE-2024-22211)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-22211

Plugin Details

Severity: Critical

ID: 408354

Version: Revision 1.5

Type: Local

Published: 4/8/2024

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-22211

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/19/2024

Reference Information

CVE: CVE-2024-22211