ISOMAN

CVE

CVE-2020-11047

In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.

Severity
MEDIUM
CVSS
5.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu20.04.6 amd64 desktopunknownsource
Ubuntu20.04.6 amd64 live-serverunknownsource

References

  1. https://github.com/FreeRDP/FreeRDP/commit/f5e73cc7c9cd973b516a618da877c87b80950b65
  2. https://github.com/FreeRDP/FreeRDP/issues/6009
  3. https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw
  4. https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
  5. https://usn.ubuntu.com/4379-1/
  6. https://github.com/FreeRDP/FreeRDP/commit/f5e73cc7c9cd973b516a618da877c87b80950b65
  7. https://github.com/FreeRDP/FreeRDP/issues/6009
  8. https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw
  9. https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
  10. https://usn.ubuntu.com/4379-1/