The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c702ea0fb1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-1b11432d52 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-982a7184e0 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6759-1 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-050266dc33 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support. (CVE-2024-32460)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default). (CVE-2024-32039)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    (CVE-2024-32041)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it     has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection     server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
    (CVE-2024-32662)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known     workarounds are available. (CVE-2024-32658)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

  - FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available. (CVE-2024-32661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
195183	Fedora 38 : freerdp (2024-c702ea0fb1)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
195182	Fedora 39 : freerdp (2024-1b11432d52)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
195180	Fedora 40 : freerdp2 (2024-982a7184e0)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical
194731	Ubuntu 24.04 LTS. : FreeRDP vulnerabilities (USN-6759-1)	Nessus	Ubuntu Local Security Checks	4/29/2024	4/29/2024	critical
195186	Fedora 40 : freerdp (2024-050266dc33)	Nessus	Fedora Local Security Checks	5/9/2024	5/9/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical