远程 AlmaLinux 8 主机存在安装的程序包该程序包受到 ALSA-2020:4647 公告中提及的多个漏洞的影响。

  - 在低于或等于 2.0.0 的 FreeRDP 中，系统会执行可能的资源耗尽漏洞。
    恶意客户端可触发越界读取，导致以随机大小分配内存。已在 2.1.0 中修复此问题。(CVE-2020-11018)

  - 在低于或等于 2.0.0 的 FreeRDP 中，在记录器设置为 WLOG_TRACE 时运行时，可能会出现应用程序崩溃，这是读取无效数组索引所致。数据可作为字符串打印到本地终端。已在 2.1.0 中修复此问题。(CVE-2020-11019)

  - 在低于或等于 2.0.0 的 FreeRDP 中，存在导致缓冲区溢出的整数溢出。使用 /video 重定向时，受操控的服务器会指示客户端分配小于所请求大小的缓冲区，这是计算大小时的整数溢出所致。通过使用后续消息，服务器可操纵客户端，以越界将数据写入到之前分配的缓冲区内。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11038)

  - 在低于或等于 2.0.0 的 FreeRDP 中，使用已启用 USB 重定向（接近）的受操纵服务器时，可能会读取和写入任意内存，这是长度检查中的整数溢出所致。此问题已在 2.1.0 进行了修补。(CVE-2020-11039)

  - 在低于或等于 2.0.0 的 FreeRDP 中，clear_decompress_subcode_rlex 中存在从内存读取的越界数据，此类数据在屏幕上以颜色显示。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11040)

  - 在低于或等于 2.0.0 的 FreeRDP 中，外部控制的数组索引在未经检查的情况下作为声音后端配置（alsa、oss、pulse 等）用于数据。最可能的结果是，客户端实例在声音消失或声音失真或会话断开后崩溃。如果用户无法升级到已修补的版本，则变通方案为禁用会话声音。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11041)

  - 在高于 1.1 和 2.0.0 之前的 FreeRDP 中，update_read_icon_info 中存在越界读取。此问题允许将攻击者定义的客户端内存数量（32 位无符号 -> 4GB）读取到中间缓冲区。可以利用此问题造成客户端崩溃或存储信息以供稍后检索。此问题已在 2.0.0 进行了修补。(CVE-2020-11042)

  - 在低于或等于 2.0.0 的 FreeRDP 中，rfx_process_message_tileset 中存在越界读取。
    馈入 RFX 解码器的无效数据导致屏幕上出现垃圾（如颜色）。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11043)

  - 在高于 1.2 和 2.0.0 之前的 FreeRDP 中，update_read_cache_bitmap_v3_order 中的双重释放导致客户端应用程序崩溃，前提是解析了来自受操纵服务器的破坏数据。此问题已在 2.0.0 进行了修补。(CVE-2020-11044)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_bitmap_data 中存在越界读取，允许将客户端内存读取到图像缓冲区。结果在屏幕上显示为颜色。
    (CVE-2020-11045)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_synchronize 中存在流越界寻找，可导致后续越界读取。(CVE-2020-11046)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，autodetect_recv_bandwidth_measure_results 中存在越界读取。恶意服务器可通过提供短输入和读取测量结果数据，利用被操纵的消息提取最多 8 字节的客户端内存。此问题已在 2.0.0 进行了修补。(CVE-2020-11047)

  - 1.0 之后和 2.0.0 之前 FreeRDP 中存在越界读取。该问题仅允许中止会话。
    无法提取任何数据。已在 2.0.0 中修复此问题。(CVE-2020-11048)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，存在对客户端内存的越界读取，然后系统会将其传递给协议解析器。此问题已在 2.0.0 进行了修补。(CVE-2020-11049)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，rdp_read_font_capability_set 中存在流越界寻找，可导致后续越界读取。因此，受操纵的客户端或服务器可能会因无效的数据读取而强制断开连接。已在 2.0.0 中修复此问题。(CVE-2020-11058)

  - 在 2.1.0 之前的 FreeRDP 中，cliprdr_read_format_list 中存在越界读取。剪贴板格式数据读取（通过客户端或服务器）可能会读取越界数据。已在 2.1.0 中修复此问题。(CVE-2020-11085)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_ntlm_v2_client_challeng 中存在越界读取，可对内部结构的最多 28 个字节进行越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11086)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_AuthenticateMessage 中存在越界读取。
    已在 2.1.0 中修复此问题。(CVE-2020-11087)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_NegotiateMessage 中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11088)

  - 在 2.1.0 之前的 FreeRDP 中，irp 函数（parallel_process_irp_create、serial_process_irp_create、drive_process_irp_write、printer_process_irp_write、rdpei_recv_pdu、serial_process_irp_write）中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11089)

  - 1.0 到 2.0.0-rc4 之间的 FreeRDP 中的 libfreerdp/gdi/gdi.c 存在越界读取。(CVE-2020-11522)

  - 1.0 到 2.0.0-rc4 之间的 FreeRDP 版本中的 libfreerdp/cache/bitmap.c 存在越界读取。
    (CVE-2020-11525)

  - 1.1 到 2.0.0-rc4 之间的 FreeRDP 版本中的 libfreerdp/core/update.c 存在越界读取。
    (CVE-2020-11526)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中检测到越界 (OOB) 读取漏洞。(CVE-2020-13396)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 libfreerdp/core/security.c 中的 security_fips_decrypt 中检测到越界 (OOB) 读取漏洞，这是值未初始化所致。
    (CVE-2020-13397)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 4647 公告中提及的多个漏洞的影响。

  - freerdp：cliprdr_server_receive_capabilities 中存在越界读取 (CVE-2020-11018)

  - freerdp：update_recv 中存在越界读取可导致崩溃 (CVE-2020-11019)

  - freerdp：VIDEO 通道中存在整数溢出 (CVE-2020-11038)

  - freerdp：usb 重定向通道中存在越界读取/写入 (CVE-2020-11039)

  - freerdp：clear_decompress_subcode_rlex 中存在越界访问 (CVE-2020-11040)

  - freerdp：rdpsnd_recv_wave2_pdu 中存在未检查的数组偏移读取 (CVE-2020-11041)

  - freerdp：update_read_icon_info 函数中存在越界读取 (CVE-2020-11042)

  - freerdp：rfx_process_message_tileset 中存在越界读取 (CVE-2020-11043)

  - freerdp：update_read_cache_bitmap_v3_order 函数中存在双重释放 (CVE-2020-11044)

  - freerdp：update_read_bitmap_data 函数中存在越界读取 (CVE-2020-11045)

  - freerdp：update_read_synchronize 函数中存在越界查找，可导致越界读取 (CVE-2020-11046)

  - freerdp：autodetect_recv_bandwidth_Measure_results 函数中存在越界读取 (CVE-2020-11047)

  - freerdp：越界读取可导致会话中止 (CVE-2020-11048)

  - freerdp：存在对客户端内存的越界读取，然后系统会将其传递给协议解析器 (CVE-2020-11049)

  - freerdp：rdp_read_font_capability_set 中存在流越界寻找，可导致越界读取 (CVE-2020-11058)

  - freerdp：cliprdr_read_format_list 函数中存在越界读取 (CVE-2020-11085)

  - freerdp：ntlm_read_ntlm_v2_client_challeng 函数中存在越界读取 (CVE-2020-11086)

  - freerdp：ntlm_read_AuthenticateMessage 中存在越界读取 (CVE-2020-11087)

  - freerdp：ntlm_read_NegotiateMessage 中存在越界读取 (CVE-2020-11088)

  - freerdp：irp 函数中存在越界读取 (CVE-2020-11089)

  - freerdp：gdi.c 中存在越界读取 (CVE-2020-11522)

  - freerdp：bitmap.c 中存在越界读取 (CVE-2020-11525)

  - freerdp：update_recv_secondary_order 中存在流指针越界，会在稍后导致越界读取 (CVE-2020-11526)

  - freerdp：winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中存在越界读取。
    (CVE-2020-13396)

  - freerdp：libfreerdp/core/security.c 的 security_fips_decrypt 中存在越界读取 (CVE-2020-13397)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 10 主机上安装的程序包受到 dla-3606 公告中提及的多个漏洞影响。

  - 在 FreeRDP 2.0.0 及更低版本中，通过提供操纵输入，恶意客户端可以创建双重释放条件并使服务器崩溃。此缺陷已在版本 2.1.0 中修复。(CVE-2020-11017)

  - 在低于或等于 2.0.0 的 FreeRDP 中，系统会执行可能的资源耗尽漏洞。
    恶意客户端可触发越界读取，导致以随机大小分配内存。已在 2.1.0 中修复此问题。(CVE-2020-11018)

  - 在低于或等于 2.0.0 的 FreeRDP 中，在记录器设置为 WLOG_TRACE 时运行时，可能会出现应用程序崩溃，这是读取无效数组索引所致。数据可作为字符串打印到本地终端。已在 2.1.0 中修复此问题。(CVE-2020-11019)

  - 在低于或等于 2.0.0 的 FreeRDP 中，存在导致缓冲区溢出的整数溢出。使用 /video 重定向时，受操控的服务器会指示客户端分配小于所请求大小的缓冲区，这是计算大小时的整数溢出所致。通过使用后续消息，服务器可操纵客户端，以越界将数据写入到之前分配的缓冲区内。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11038)

  - 在低于或等于 2.0.0 的 FreeRDP 中，使用已启用 USB 重定向（接近）的受操纵服务器时，可能会读取和写入任意内存，这是长度检查中的整数溢出所致。此问题已在 2.1.0 进行了修补。(CVE-2020-11039)

  - 在低于或等于 2.0.0 的 FreeRDP 中，clear_decompress_subcode_rlex 中存在从内存读取的越界数据，此类数据在屏幕上以颜色显示。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11040)

  - 在低于或等于 2.0.0 的 FreeRDP 中，外部控制的数组索引在未经检查的情况下作为声音后端配置（alsa、oss、pulse 等）用于数据。最可能的结果是，客户端实例在声音消失或声音失真或会话断开后崩溃。如果用户无法升级到已修补的版本，则变通方案为禁用会话声音。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11041)

  - 在高于 1.1 和 2.0.0 之前的 FreeRDP 中，update_read_icon_info 中存在越界读取。此问题允许将攻击者定义的客户端内存数量（32 位无符号 -> 4GB）读取到中间缓冲区。可以利用此问题造成客户端崩溃或存储信息以供稍后检索。此问题已在 2.0.0 进行了修补。(CVE-2020-11042)

  - 在低于或等于 2.0.0 的 FreeRDP 中，rfx_process_message_tileset 中存在越界读取。
    馈入 RFX 解码器的无效数据导致屏幕上出现垃圾（如颜色）。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11043)

  - 在高于 1.2 和 2.0.0 之前的 FreeRDP 中，update_read_cache_bitmap_v3_order 中的双重释放导致客户端应用程序崩溃，前提是解析了来自受操纵服务器的破坏数据。此问题已在 2.0.0 进行了修补。(CVE-2020-11044)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_bitmap_data 中存在越界读取，允许将客户端内存读取到图像缓冲区。结果在屏幕上显示为颜色。
    (CVE-2020-11045)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_synchronize 中存在流越界寻找，可导致后续越界读取。(CVE-2020-11046)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，autodetect_recv_bandwidth_measure_results 中存在越界读取。恶意服务器可通过提供短输入和读取测量结果数据，利用被操纵的消息提取最多 8 字节的客户端内存。此问题已在 2.0.0 进行了修补。(CVE-2020-11047)

  - 1.0 之后和 2.0.0 之前 FreeRDP 中存在越界读取。该问题仅允许中止会话。
    无法提取任何数据。已在 2.0.0 中修复此问题。(CVE-2020-11048)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，存在对客户端内存的越界读取，然后系统会将其传递给协议解析器。此问题已在 2.0.0 进行了修补。(CVE-2020-11049)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，rdp_read_font_capability_set 中存在流越界寻找，可导致后续越界读取。因此，受操纵的客户端或服务器可能会因无效的数据读取而强制断开连接。已在 2.0.0 中修复此问题。(CVE-2020-11058)

  - 在 2.1.0 之前的 FreeRDP 中，cliprdr_read_format_list 中存在越界读取。剪贴板格式数据读取（通过客户端或服务器）可能会读取越界数据。已在 2.1.0 中修复此问题。(CVE-2020-11085)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_ntlm_v2_client_challeng 中存在越界读取，可对内部结构的最多 28 个字节进行越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11086)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_AuthenticateMessage 中存在越界读取。
    已在 2.1.0 中修复此问题。(CVE-2020-11087)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_NegotiateMessage 中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11088)

  - 在 2.1.0 之前的 FreeRDP 中，irp 函数（parallel_process_irp_create、serial_process_irp_create、drive_process_irp_write、printer_process_irp_write、rdpei_recv_pdu、serial_process_irp_write）中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11089)

  - 在版本 2.1.2 之前的 FreeRDP 中，发生越界读取，会导致访问静态数组 PRIMARY_DRAWING_ORDER_FIELD_BYTES 边界之外的内存位置。此缺陷已在版本 2.1.2 中修复。(CVE-2020-11095)

  - 在版本 2.1.2 之前的 FreeRDP 中，update_read_cache_bitmap_v3_order 存在全局 OOB 读取。作为变通方案，可使用 -bitmap-cache（默认值）禁用位图缓存。此缺陷已在版本 2.1.2 中修复。
    (CVE-2020-11096)

  - 在版本 2.1.2 之前的 FreeRDP 中，发生越界读取，会导致访问静态数组 PRIMARY_DRAWING_ORDER_FIELD_BYTES 边界之外的内存位置。此缺陷已在版本 2.1.2 中修复。(CVE-2020-11097)

  - 在版本 2.1.2 之前的 FreeRDP 中，glyph_cache_put 存在越界读取。这会影响所有启用“+glyph-cache”选项的 FreeRDP 客户端。此漏洞已在版本 2.1.2 中修复。(CVE-2020-11098)

  - 在版本 (2.1.2) 之前的 FreeRDP 中，License_read_new_or_upgrade_license_packet 存在越界读取问题。受操纵的许可证数据包可导致内部缓冲区的越界读取。此缺陷已在版本 2.1.2 中修复。(CVE-2020-11099)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中检测到越界 (OOB) 读取漏洞。(CVE-2020-13396)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 libfreerdp/core/security.c 中的 security_fips_decrypt 中检测到越界 (OOB) 读取漏洞，这是值未初始化所致。
    (CVE-2020-13397)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。libfreerdp/crypto/crypto.c 的 crypto_rsa_common 中检测出越界 (OOB) 写入漏洞。(CVE-2020-13398)

  - 在 2.1.2 及之前的 FreeRDP 中，因 rdpegfx 通道中缺少输入审查而存在整数溢出问题。所有 FreeRDP 客户端均会受到影响。未针对本地平台坐标检查就盲目接受来自服务器的输入矩形。恶意服务器可发送将在稍后导致客户端崩溃的数据（“memcpy”的无效长度参数）此问题已在 2.2.0 中修复。作为变通方案，停止使用命令行参数 /gfx、/gfx-h264 和 /network: auto (CVE-2020-15103)

  - 在版本 2.1.2 之前的 FreeRDP 中，TrioParse 存在越界读取。由于整数溢出，日志记录可能绕过字符串长度检查。此缺陷已在版本 2.1.2 中修复。(CVE-2020-4030)

  - 在 2.1.2 版本之前的 FreeRDP 中，gdi_SelectObject 存在释放后使用漏洞。所有通过 /relax-order-checks 使用兼容模式的 FreeRDP 客户端都会受到影响。此缺陷已在版本 2.1.2 中修复。(CVE-2020-4031)

  - 在 2.1.2 版本之前的 FreeRDP 中，update_recv_secondary_order 存在整数转换漏洞。
    所有使用 +glyph-cache/relax-order-checks 的客户端都会受到影响。此缺陷已在版本 2.1.2 中修复。
    (CVE-2020-4032)

  - 在版本 2.1.2 之前的 FreeRDP 中，RLEDECOMPRESS 存在越界读取。所有具有颜色深度 < 32 会话的基于 FreeRDP 的客户端都会受到影响。此缺陷已在版本 2.1.2 中修复。(CVE-2020-4033)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    此问题仅会影响客户端。整数下溢导致 DOS（例如，由于具有默认编译标记的“WINPR_ASSERT”而中止）。当提供的 blockLen 不足且未执行适当的长度验证时，就会发生整数下溢，从而导致拒绝服务 (DOS) 漏洞。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39350)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的 FreeRDP 版本会受到空指针取消引用的影响，从而导致 RemoteFX (rfx) 处理崩溃。在“rfx_process_message_tileset”函数内部，程序会使用 `rfx_allocate_tiles` 就 numTiles 的数量分配图块。如果由于各种原因图块的初始化流程都未能完成，图块中将会出现空指针。这可能会在后续处理中被访问并造成程序崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39351)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会受到无效偏移验证的影响，从而导致越界写入。如果值“rect->left”和“rect->top”完全等于“surface->width”和“surface->height”，则会触发此问题。例如，rect->left = surface->width 以及 rect->top = surface->height。实际上，这应该会导致崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39352)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会受到缺少偏移验证的影响，从而导致越界读取。在 `libfreerdp/codec/rfx.c` 文件中， `tile->quantIdxY`、`tile->quantIdxCb` 和 `tile->quantIdxCr` 中尚无偏移验证。因此，特制的输入可能会导致越界读取访问，进而造成崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39353)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会在 `nsc_rle_decompress_data` 函数中受到越界读取的影响。发生越界读取的原因是其处理 `context->Planes` 时没有检查它是否包含足够长度的数据。如果攻击者能够利用此漏洞，他们就可能会造成崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。
    目前尚无针对此漏洞的变通方案。(CVE-2023-39354)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    beta3 之前的 3.x 版本分支中的 FreeRDP 版本在处理“RDPGFX_CMDID_RESETGRAPHICS”数据包时会受到“释放后使用”的影响。如果“context->maxPlaneSize”为 0，“context->planesBuffer”将被释放。然而，如果不更新“context->planesBuffer”，这会导致“释放后使用漏洞”利用向量。
    在大多数环境中，这只会导致崩溃。此问题已在 3.0.0-beta3 版本中解决，建议使用 beta 版本 3.x 的用户进行升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39355)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    在受影响的版本中，缺少偏移验证可能会导致函数“gdi_multi_opaque_rect”出现越界读取。特别是没有代码来验证值“multi_opaque_rect->numRectangles”是否小于 45。在没有适当边界检查的情况下，循环遍历“multi_opaque_rect->numRectangles”可能会导致越界读取错误，这可能会导致崩溃。
    此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-39356)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会受到整数下溢的影响，进而导致 `zgfx_decompress_segment` 函数中的越界读取。在 `CopyMemory` 的环境中，可以读取超出传输数据包范围的数据，并可能造成崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此问题的解决方案。(CVE-2023-40181)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会受到 IntegerOverflow 的影响，导致 `gdi_CreateSurface` 函数中出现越界写入漏洞。此问题仅会影响基于 FreeRDP 的客户端。FreeRDP 代理不受影响，因为图像解码并非由代理完成。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此问题的解决方案。(CVE-2023-40186)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会在 `general_LumaToYUV444` 函数中受到越界读取的影响。发生越界读取的原因是处理流程是在 `in` 变量中完成，但并未检查其是否包含足够长度的数据。`in` 变量的数据不足可能会造成错误或崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此问题的解决方案。(CVE-2023-40188)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会受到 `clear_decompress_bands_data` 函数中的越界写入的影响，其中并无偏移验证。滥用此漏洞可能会导致越界写入。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-40567)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    受影响的版本会在 `progressive_decompress` 函数中受到越界写入的影响。此问题可以归结为 `nXSrc` 和 `nYSrc` 变量的错误计算。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此漏洞的变通方案。(CVE-2023-40569)

  - FreeRDP 是远程桌面协议 (RDP) 的免费实现，依据 Apache 许可发布。
    在受影响的版本中，ncrush_decompress 函数中存在全局缓冲区溢出。向此函数提供特制输入可能会触发溢出，而这仅会显示为造成致崩溃。此问题已在 2.11.0 和 3.0.0-beta3 版中解决。建议用户升级。目前尚无针对此问题的解决方案。(CVE-2023-40589)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Rocky Linux 8 主机上存在安装的程序包该程序包受到公告 RLSA-2020:4647 中提及的多个漏洞的影响。

  - 在低于或等于 2.0.0 的 FreeRDP 中，系统会执行可能的资源耗尽漏洞。
    恶意客户端可触发越界读取，导致以随机大小分配内存。已在 2.1.0 中修复此问题。(CVE-2020-11018)

  - 在低于或等于 2.0.0 的 FreeRDP 中，在记录器设置为 WLOG_TRACE 时运行时，可能会出现应用程序崩溃，这是读取无效数组索引所致。数据可作为字符串打印到本地终端。已在 2.1.0 中修复此问题。(CVE-2020-11019)

  - 在低于或等于 2.0.0 的 FreeRDP 中，存在导致缓冲区溢出的整数溢出。使用 /video 重定向时，受操控的服务器会指示客户端分配小于所请求大小的缓冲区，这是计算大小时的整数溢出所致。通过使用后续消息，服务器可操纵客户端，以越界将数据写入到之前分配的缓冲区内。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11038)

  - 在低于或等于 2.0.0 的 FreeRDP 中，使用已启用 USB 重定向（接近）的受操纵服务器时，可能会读取和写入任意内存，这是长度检查中的整数溢出所致。此问题已在 2.1.0 进行了修补。(CVE-2020-11039)

  - 在低于或等于 2.0.0 的 FreeRDP 中，clear_decompress_subcode_rlex 中存在从内存读取的越界数据，此类数据在屏幕上以颜色显示。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11040)

  - 在低于或等于 2.0.0 的 FreeRDP 中，外部控制的数组索引在未经检查的情况下作为声音后端配置（alsa、oss、pulse 等）用于数据。最可能的结果是，客户端实例在声音消失或声音失真或会话断开后崩溃。如果用户无法升级到已修补的版本，则变通方案为禁用会话声音。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11041)

  - 在高于 1.1 和 2.0.0 之前的 FreeRDP 中，update_read_icon_info 中存在越界读取。此问题允许将攻击者定义的客户端内存数量（32 位无符号 -> 4GB）读取到中间缓冲区。可以利用此问题造成客户端崩溃或存储信息以供稍后检索。此问题已在 2.0.0 进行了修补。(CVE-2020-11042)

  - 在低于或等于 2.0.0 的 FreeRDP 中，rfx_process_message_tileset 中存在越界读取。
    馈入 RFX 解码器的无效数据导致屏幕上出现垃圾（如颜色）。此问题已在 2.1.0 进行了修补。
    (CVE-2020-11043)

  - 在高于 1.2 和 2.0.0 之前的 FreeRDP 中，update_read_cache_bitmap_v3_order 中的双重释放导致客户端应用程序崩溃，前提是解析了来自受操纵服务器的破坏数据。此问题已在 2.0.0 进行了修补。(CVE-2020-11044)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_bitmap_data 中存在越界读取，允许将客户端内存读取到图像缓冲区。结果在屏幕上显示为颜色。
    (CVE-2020-11045)

  - 在 1.0 之后和 2.0.0 之前的 FreeRDP 中，update_read_synchronize 中存在流越界寻找，可导致后续越界读取。(CVE-2020-11046)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，autodetect_recv_bandwidth_measure_results 中存在越界读取。恶意服务器可通过提供短输入和读取测量结果数据，利用被操纵的消息提取最多 8 字节的客户端内存。此问题已在 2.0.0 进行了修补。(CVE-2020-11047)

  - 1.0 之后和 2.0.0 之前 FreeRDP 中存在越界读取。该问题仅允许中止会话。
    无法提取任何数据。已在 2.0.0 中修复此问题。(CVE-2020-11048)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，存在对客户端内存的越界读取，然后系统会将其传递给协议解析器。此问题已在 2.0.0 进行了修补。(CVE-2020-11049)

  - 在 1.1 之后和 2.0.0 之前的 FreeRDP 中，rdp_read_font_capability_set 中存在流越界寻找，可导致后续越界读取。因此，受操纵的客户端或服务器可能会因无效的数据读取而强制断开连接。已在 2.0.0 中修复此问题。(CVE-2020-11058)

  - 在 2.1.0 之前的 FreeRDP 中，cliprdr_read_format_list 中存在越界读取。剪贴板格式数据读取（通过客户端或服务器）可能会读取越界数据。已在 2.1.0 中修复此问题。(CVE-2020-11085)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_ntlm_v2_client_challeng 中存在越界读取，可对内部结构的最多 28 个字节进行越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11086)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_AuthenticateMessage 中存在越界读取。
    已在 2.1.0 中修复此问题。(CVE-2020-11087)

  - 在低于或等于 2.0.0 的 FreeRDP 中，ntlm_read_NegotiateMessage 中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11088)

  - 在 2.1.0 之前的 FreeRDP 中，irp 函数（parallel_process_irp_create、serial_process_irp_create、drive_process_irp_write、printer_process_irp_write、rdpei_recv_pdu、serial_process_irp_write）中存在越界读取。已在 2.1.0 中修复此问题。(CVE-2020-11089)

  - 1.0 到 2.0.0-rc4 之间的 FreeRDP 中的 libfreerdp/gdi/gdi.c 存在越界读取。(CVE-2020-11522)

  - 1.0 到 2.0.0-rc4 之间的 FreeRDP 版本中的 libfreerdp/cache/bitmap.c 存在越界读取。
    (CVE-2020-11525)

  - 1.1 到 2.0.0-rc4 之间的 FreeRDP 版本中的 libfreerdp/core/update.c 存在越界读取。
    (CVE-2020-11526)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 winpr/libwinpr/sspi/NTLM/ntlm_message.c 的 ntlm_read_ChallengeMessage 中检测到越界 (OOB) 读取漏洞。(CVE-2020-13396)

  - 2.1.1 之前的 FreeRDP 版本中发现一个问题。在 libfreerdp/core/security.c 中的 security_fips_decrypt 中检测到越界 (OOB) 读取漏洞，这是值未初始化所致。
    (CVE-2020-13397)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote NewStart CGSL host, running version MAIN 6.02, has freerdp packages installed that are affected by multiple vulnerabilities:

  - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes     the client application if corrupted data from a manipulated server is parsed. This has been patched in     2.0.0. (CVE-2020-11044)

  - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
    (CVE-2020-11526)

  - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It     allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate     buffer. This can be used to crash the client or store information for later retrieval. This has been     patched in 2.0.0. (CVE-2020-11042)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The result displayed on screen as colour.
    (CVE-2020-11045)

  - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize     that could lead to a later out-of-bounds read. (CVE-2020-11046)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in     autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory     with a manipulated message by providing a short input and reading the measurement result data. This has     been patched in 2.0.0. (CVE-2020-11047)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.
    No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed     on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)

  - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could     lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect     due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
    (CVE-2020-13397)

  - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data     read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in     ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This     has been fixed in 2.1.0. (CVE-2020-11086)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.
    This has been fixed in 2.1.0. (CVE-2020-11087)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This     has been fixed in 2.1.0. (CVE-2020-11088)

  - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,     serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,     serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)

  - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.
    Malicious clients could trigger out of bound reads causing memory allocation with random size. This has     been fixed in 2.1.0. (CVE-2020-11018)

  - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of     application could occur due to a read of an invalid array index. Data could be printed as string to local     terminal. This has been fixed in 2.1.0. (CVE-2020-11019)

  - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video     redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than     requested due to an integer overflow in size calculation. With later messages, the server can manipulate     the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
    (CVE-2020-11038)

  - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled     (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been     patched in 2.1.0. (CVE-2020-11039)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in     clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
    (CVE-2020-11040)

  - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used     as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the     client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the     patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
    (CVE-2020-11041)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.
    Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.
    (CVE-2020-11043)

  - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)

  - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
    (CVE-2020-11525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4647 advisory.

    freerdp     [2:2.1.1-1]
    - Update to 2.1.1 (rhbz#1834287).

    [2:2.0.0-47.rc4]
    - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
    - Do not advertise /usb in help output (rhbz#1761144)

    vinagre     [3.22.0-23]
    - Remove unused variable (CovScan)
    - Related: #1839744

    [3.22.0-22]
    - Rebuild due to new version of FreeRDP
    - Fix an issue when RDP connection shows just black screen
    - Resolves: #1839744

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has freerdp packages installed that are affected by multiple vulnerabilities:

  - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.
    Malicious clients could trigger out of bound reads causing memory allocation with random size. This has     been fixed in 2.1.0. (CVE-2020-11018)

  - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of     application could occur due to a read of an invalid array index. Data could be printed as string to local     terminal. This has been fixed in 2.1.0. (CVE-2020-11019)

  - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video     redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than     requested due to an integer overflow in size calculation. With later messages, the server can manipulate     the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
    (CVE-2020-11038)

  - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled     (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been     patched in 2.1.0. (CVE-2020-11039)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in     clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
    (CVE-2020-11040)

  - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used     as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the     client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the     patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
    (CVE-2020-11041)

  - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It     allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate     buffer. This can be used to crash the client or store information for later retrieval. This has been     patched in 2.0.0. (CVE-2020-11042)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.
    Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.
    (CVE-2020-11043)

  - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes     the client application if corrupted data from a manipulated server is parsed. This has been patched in     2.0.0. (CVE-2020-11044)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The result displayed on screen as colour.
    (CVE-2020-11045)

  - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize     that could lead to a later out-of-bounds read. (CVE-2020-11046)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in     autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory     with a manipulated message by providing a short input and reading the measurement result data. This has     been patched in 2.0.0. (CVE-2020-11047)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.
    No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed     on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)

  - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could     lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect     due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)

  - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data     read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in     ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This     has been fixed in 2.1.0. (CVE-2020-11086)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.
    This has been fixed in 2.1.0. (CVE-2020-11087)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This     has been fixed in 2.1.0. (CVE-2020-11088)

  - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,     serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,     serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)

  - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)

  - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
    (CVE-2020-11525)

  - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
    (CVE-2020-11526)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
    (CVE-2020-13397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4647 advisory.

  - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.
    Malicious clients could trigger out of bound reads causing memory allocation with random size. This has     been fixed in 2.1.0. (CVE-2020-11018)

  - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of     application could occur due to a read of an invalid array index. Data could be printed as string to local     terminal. This has been fixed in 2.1.0. (CVE-2020-11019)

  - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video     redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than     requested due to an integer overflow in size calculation. With later messages, the server can manipulate     the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
    (CVE-2020-11038)

  - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled     (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been     patched in 2.1.0. (CVE-2020-11039)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in     clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
    (CVE-2020-11040)

  - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used     as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the     client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the     patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
    (CVE-2020-11041)

  - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It     allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate     buffer. This can be used to crash the client or store information for later retrieval. This has been     patched in 2.0.0. (CVE-2020-11042)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.
    Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.
    (CVE-2020-11043)

  - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes     the client application if corrupted data from a manipulated server is parsed. This has been patched in     2.0.0. (CVE-2020-11044)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The result displayed on screen as colour.
    (CVE-2020-11045)

  - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize     that could lead to a later out-of-bounds read. (CVE-2020-11046)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in     autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory     with a manipulated message by providing a short input and reading the measurement result data. This has     been patched in 2.0.0. (CVE-2020-11047)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.
    No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed     on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)

  - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could     lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect     due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)

  - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data     read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in     ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This     has been fixed in 2.1.0. (CVE-2020-11086)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.
    This has been fixed in 2.1.0. (CVE-2020-11087)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This     has been fixed in 2.1.0. (CVE-2020-11088)

  - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,     serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,     serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)

  - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)

  - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
    (CVE-2020-11525)

  - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
    (CVE-2020-11526)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
    (CVE-2020-13397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for freerdp fixes the following issues :

frerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006) :

  - CVE-2020-11017: Fixed a double free which could have     denied the server's service.

  - CVE-2020-11018: Fixed an out of bounds read which a     malicious clients could have triggered.

  - CVE-2020-11019: Fixed an issue which could have led to     denial of service if logger was set to 'WLOG_TRACE'.

  - CVE-2020-11038: Fixed a buffer overflow when /video     redirection was used.

  - CVE-2020-11039: Fixed an issue which could have allowed     arbitrary memory read and write when USB redirection was     enabled.

  - CVE-2020-11040: Fixed an out of bounds data read in     clear_decompress_subcode_rlex.

  - CVE-2020-11041: Fixed an issue with the configuration     for sound backend which could have led to server's     denial of service.

  - CVE-2020-11043: Fixed an out of bounds read in     rfx_process_message_tileset.

  - CVE-2020-11085: Fixed an out of bounds read in     cliprdr_read_format_list.

  - CVE-2020-11086: Fixed an out of bounds read in     ntlm_read_ntlm_v2_client_challenge.

  - CVE-2020-11087: Fixed an out of bounds read in     ntlm_read_AuthenticateMessage.

  - CVE-2020-11088: Fixed an out of bounds read in     ntlm_read_NegotiateMessage.

  - CVE-2020-11089: Fixed an out of bounds read in irp     function family.

  - CVE-2020-11095: Fixed a global out of bounds read in     update_recv_primary_order.

  - CVE-2020-11096: Fixed a global out of bounds read in     update_read_cache_bitmap_v3_order.

  - CVE-2020-11097: Fixed an out of bounds read in     ntlm_av_pair_get.

  - CVE-2020-11098: Fixed an out of bounds read in     glyph_cache_put.

  - CVE-2020-11099: Fixed an out of bounds Read in     license_read_new_or_upgrade_license_packet.

  - CVE-2020-11521: Fixed an out of bounds write in planar.c     (bsc#1171443).

  - CVE-2020-11522: Fixed an out of bounds read in gdi.c     (bsc#1171444).

  - CVE-2020-11523: Fixed an integer overflow in region.c     (bsc#1171445).

  - CVE-2020-11524: Fixed an out of bounds write in     interleaved.c (bsc#1171446).

  - CVE-2020-11525: Fixed an out of bounds read in bitmap.c     (bsc#1171447).

  - CVE-2020-11526: Fixed an out of bounds read in     update_recv_secondary_order (bsc#1171674).

  - CVE-2020-13396: Fixed an Read in     ntlm_read_ChallengeMessage.

  - CVE-2020-13397: Fixed an out of bounds read in     security_fips_decrypt due to uninitialized value.

  - CVE-2020-13398: Fixed an out of bounds write in     crypto_rsa_common.

  - CVE-2020-4030: Fixed an out of bounds read in     `TrioParse`.

  - CVE-2020-4031: Fixed a use after free in     gdi_SelectObject.

  - CVE-2020-4032: Fixed an integer casting in     `update_recv_secondary_order`.

  - CVE-2020-4033: Fixed an out of bound read in     RLEDECOMPRESS.

  - Fixed an issue where freerdp failed with -fno-common     (bsc#1169748).

  - Fixed an issue where USB redirection with FreeRDP was     not working (bsc#1169679).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4647 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    The vinagre packages provide the Vinagre remote desktop viewer for the GNOME desktop.

    The following packages have been upgraded to a later upstream version: freerdp (2.1.1). (BZ#1834287)

    Security Fix(es):

    * freerdp: Out of bound read in cliprdr_server_receive_capabilities (CVE-2020-11018)

    * freerdp: Out of bound read/write in usb redirection channel (CVE-2020-11039)

    * freerdp: out-of-bounds read in update_read_icon_info function (CVE-2020-11042)

    * freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function (CVE-2020-11047)

    * freerdp: Out-of-bounds read in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
    (CVE-2020-13396)

    * freerdp: Out-of-bounds read in security_fips_decrypt in libfreerdp/core/security.c (CVE-2020-13397)

    * freerdp: Out of bound read in update_recv could result in a crash (CVE-2020-11019)

    * freerdp: Integer overflow in VIDEO channel (CVE-2020-11038)

    * freerdp: Out of bound access in clear_decompress_subcode_rlex (CVE-2020-11040)

    * freerdp: Unchecked read of array offset in rdpsnd_recv_wave2_pdu (CVE-2020-11041)

    * freerdp: out of bound read in rfx_process_message_tileset (CVE-2020-11043)

    * freerdp: double free in update_read_cache_bitmap_v3_order function (CVE-2020-11044)

    * freerdp: out of bounds read in update_read_bitmap_data function (CVE-2020-11045)

    * freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read     (CVE-2020-11046)

    * freerdp: out-of-bounds read could result in aborting the session (CVE-2020-11048)

    * freerdp: out-of-bound read of client memory that is then passed on to the protocol parser     (CVE-2020-11049)

    * freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read     (CVE-2020-11058)

    * freerdp: out-of-bounds read in cliprdr_read_format_list function (CVE-2020-11085)

    * freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function (CVE-2020-11086)

    * freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage (CVE-2020-11087)

    * freerdp: out-of-bounds read in ntlm_read_NegotiateMessage (CVE-2020-11088)

    * freerdp: out-of-bounds read in irp functions (CVE-2020-11089)

    * freerdp: out-of-bounds read in gdi.c (CVE-2020-11522)

    * freerdp: out-of-bounds read in bitmap.c (CVE-2020-11525)

    * freerdp: Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later     (CVE-2020-11526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4647 advisory.

  - In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed.
    Malicious clients could trigger out of bound reads causing memory allocation with random size. This has     been fixed in 2.1.0. (CVE-2020-11018)

  - In FreeRDP less than or equal to 2.0.0, when running with logger set to WLOG_TRACE, a possible crash of     application could occur due to a read of an invalid array index. Data could be printed as string to local     terminal. This has been fixed in 2.1.0. (CVE-2020-11019)

  - In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video     redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than     requested due to an integer overflow in size calculation. With later messages, the server can manipulate     the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
    (CVE-2020-11038)

  - In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled     (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been     patched in 2.1.0. (CVE-2020-11039)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in     clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
    (CVE-2020-11040)

  - In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used     as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the     client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the     patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
    (CVE-2020-11041)

  - In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It     allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate     buffer. This can be used to crash the client or store information for later retrieval. This has been     patched in 2.0.0. (CVE-2020-11042)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset.
    Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.
    (CVE-2020-11043)

  - In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes     the client application if corrupted data from a manipulated server is parsed. This has been patched in     2.0.0. (CVE-2020-11044)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that     allows client memory to be read to an image buffer. The result displayed on screen as colour.
    (CVE-2020-11045)

  - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize     that could lead to a later out-of-bounds read. (CVE-2020-11046)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in     autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory     with a manipulated message by providing a short input and reading the measurement result data. This has     been patched in 2.0.0. (CVE-2020-11047)

  - In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session.
    No data extraction is possible. This has been fixed in 2.0.0. (CVE-2020-11048)

  - In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed     on to the protocol parser. This has been patched in 2.0.0. (CVE-2020-11049)

  - In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could     lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect     due to an invalid data read. This has been fixed in 2.0.0. (CVE-2020-11058)

  - In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data     read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. (CVE-2020-11085)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in     ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This     has been fixed in 2.1.0. (CVE-2020-11086)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage.
    This has been fixed in 2.1.0. (CVE-2020-11087)

  - In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This     has been fixed in 2.1.0. (CVE-2020-11088)

  - In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create,     serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu,     serial_process_irp_write). This has been fixed in 2.1.0. (CVE-2020-11089)

  - libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (CVE-2020-11522)

  - libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
    (CVE-2020-11525)

  - libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
    (CVE-2020-11526)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. (CVE-2020-13396)

  - An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been     detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
    (CVE-2020-13397)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
157652	AlmaLinux 8freerdp 与 vinagre (ALSA-2020:4647)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	high
142401	RHEL 8：freerdp 和 vinagre (RHSA-2020: 4647)	Nessus	Red Hat Local Security Checks	11/4/2020	11/7/2024	high
182754	Debian DLA-3606-1：freerdp2 - LTS 安全更新	Nessus	Debian Local Security Checks	10/8/2023	1/22/2025	critical
184677	Rocky Linux 8freerdp 和 vinagre (RLSA-2020:4647)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high
147314	NewStart CGSL MAIN 6.02 : freerdp Multiple Vulnerabilities (NS-SA-2021-0083)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	1/11/2024	high
142775	Oracle Linux 8 : freerdp / and / vinagre (ELSA-2020-4647)	Nessus	Oracle Linux Local Security Checks	11/12/2020	11/1/2024	high
154454	NewStart CGSL CORE 5.05 / MAIN 5.05 : freerdp Multiple Vulnerabilities (NS-SA-2021-0172)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	11/27/2023	high
157652	AlmaLinux 8 : freerdp and vinagre (ALSA-2020:4647)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	high
139018	openSUSE Security Update : freerdp (openSUSE-2020-1090)	Nessus	SuSE Local Security Checks	7/28/2020	2/28/2024	high
142401	RHEL 8 : freerdp and vinagre (RHSA-2020:4647)	Nessus	Red Hat Local Security Checks	11/4/2020	11/7/2024	high
182754	Debian dla-3606 : freerdp2-dev - security update	Nessus	Debian Local Security Checks	10/8/2023	1/22/2025	critical
184677	Rocky Linux 8 : freerdp and vinagre (RLSA-2020:4647)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high

high

high

high

critical

high