Out-Of-Bounds Write in FreeRDP
CVE-2023-40569

6.5MEDIUM

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
31 August 2023

What is CVE-2023-40569?

A vulnerability has been identified in the FreeRDP implementation of the Remote Desktop Protocol, which allows for an Out-Of-Bounds Write in the progressive_decompress function. This flaw arises from incorrect calculations of the nXSrc and nYSrc variables, potentially leading to unexpected behavior. Users are strongly encouraged to upgrade to the latest versions, specifically 2.11.0 or 3.0.0-beta3, as there are no known workarounds for this security issue.

Affected Version(s)

FreeRDP < 2.11.0 < 2.11.0

FreeRDP >= 3.0.0-beta1, < 3.0.0-beta3 < 3.0.0-beta1, 3.0.0-beta3

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a...
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.