Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-4478: A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | freerdp | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-debuginfo | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-debugsource | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-libs-debuginfo | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | freerdp-server-debuginfo | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libwinpr-debuginfo | 2:3.6.3-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.1 |
Vulnerabilities 1
-
Medium 6.5
Gnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of service
A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is li…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-4478.html