Vulnerability CVE-2022-39316: Information
Description
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
Severity: MEDIUM (5.7) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| freerdp | sisyphus | 2.9.0-alt1 | 2.11.7-alt4 | ALT-PU-2022-3127-1 | 310190 | Fixed |
| freerdp | sisyphus_e2k | 2.9.0-alt1 | 2.11.7-alt3 | ALT-PU-2022-7162-1 | - | Fixed |
| freerdp | sisyphus_riscv64 | 2.9.0-alt1 | 2.11.7-alt4 | ALT-PU-2022-7143-1 | - | Fixed |
| freerdp | p10 | 2.9.0-alt1 | 2.11.7-alt3 | ALT-PU-2022-3199-1 | 310220 | Fixed |
| freerdp | p10_e2k | 2.9.0-alt1 | 2.11.7-alt3 | ALT-PU-2022-7252-1 | - | Fixed |
| freerdp | p9 | 2.9.0-alt1 | 2.9.0-alt1 | ALT-PU-2022-3288-1 | 310221 | Fixed |
| freerdp | c10f2 | 2.9.0-alt1 | 2.11.7-alt3 | ALT-PU-2022-3199-1 | 310220 | Fixed |
| freerdp | c9f2 | 2.9.0-alt1 | 2.11.7-alt1 | ALT-PU-2022-3189-1 | 310222 | Fixed |