The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6749-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1610-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c702ea0fb1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.6. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-110-01 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-1b11432d52 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-982a7184e0 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1609-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2537 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-050266dc33 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193871	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : FreeRDP vulnerabilities (USN-6749-1)	Nessus	Ubuntu Local Security Checks	4/25/2024	4/26/2024	critical
195474	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : freerdp (SUSE-SU-2024:1610-1)	Nessus	SuSE Local Security Checks	5/11/2024	5/11/2024	critical
195183	Fedora 38 : freerdp (2024-c702ea0fb1)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
193602	Slackware Linux 15.0 / current freerdp Multiple Vulnerabilities (SSA:2024-110-01)	Nessus	Slackware Local Security Checks	4/19/2024	4/26/2024	critical
195182	Fedora 39 : freerdp (2024-1b11432d52)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
195180	Fedora 40 : freerdp2 (2024-982a7184e0)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
195336	SUSE SLED12 / SLES12 Security Update : freerdp (SUSE-SU-2024:1609-1)	Nessus	SuSE Local Security Checks	5/11/2024	5/11/2024	critical
197113	Amazon Linux 2 : freerdp (ALAS-2024-2537)	Nessus	Amazon Linux Local Security Checks	5/15/2024	5/16/2024	critical
195186	Fedora 40 : freerdp (2024-050266dc33)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical