Skip to content
OpenAdvisories
Medium ALSA-2024:2208 12 CVEs

Moderate: freerdp security update

Published Apr 30, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)
* freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)
* freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)
* freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356)
* freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186)
* freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)
* freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations (CVE-2023-40569)
* freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)
* freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)
* freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)
* freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)
* freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 9 freerdp 2:2.11.2-1.el9
AlmaLinux · 9 freerdp-devel 2:2.11.2-1.el9
AlmaLinux · 9 freerdp-libs 2:2.11.2-1.el9
AlmaLinux · 9 libwinpr 2:2.11.2-1.el9
AlmaLinux · 9 libwinpr-devel 2:2.11.2-1.el9

Vulnerabilities 12

  • Medium 6.5
    CVE-2023-40186

    IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects F…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2023-40567

    Out-Of-Bounds Write in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of th…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2023-40569

    Out-Of-Bounds Write in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2023-39350

    Incorrect offset calculation leading to denial of service in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2023-39354

    FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `con…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39351

    FreeRDP Null Pointer Dereference leading denial of service

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_ti…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39352

    Invalid offset validation leading to Out Of Bound Write in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39353

    Missing offset validation leading to Out Of Bound Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset valida…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39356

    Missing offset validation leading to Out-of-Bounds Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-40181

    Integer-Underflow leading to Out-Of-Bound Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-40188

    Out-Of-Bounds Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2023-40589

    FreeRDP Global-Buffer-Overflow in ncrush_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overfl…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-39350
  • report
    https://access.redhat.com/security/cve/CVE-2023-39351
  • report
    https://access.redhat.com/security/cve/CVE-2023-39352
  • report
    https://access.redhat.com/security/cve/CVE-2023-39353
  • report
    https://access.redhat.com/security/cve/CVE-2023-39354
  • report
    https://access.redhat.com/security/cve/CVE-2023-39356
  • report
    https://access.redhat.com/security/cve/CVE-2023-40181
  • report
    https://access.redhat.com/security/cve/CVE-2023-40186
  • report
    https://access.redhat.com/security/cve/CVE-2023-40188
  • report
    https://access.redhat.com/security/cve/CVE-2023-40567
  • report
    https://access.redhat.com/security/cve/CVE-2023-40569
  • report
    https://access.redhat.com/security/cve/CVE-2023-40589
  • report
    https://bugzilla.redhat.com/2236606
  • report
    https://bugzilla.redhat.com/2236650
  • report
    https://bugzilla.redhat.com/2236656
  • report
    https://bugzilla.redhat.com/2236669
  • report
    https://bugzilla.redhat.com/2236730
  • report
    https://bugzilla.redhat.com/2236750
  • report
    https://bugzilla.redhat.com/2236759
  • report
    https://bugzilla.redhat.com/2236763
  • report
    https://bugzilla.redhat.com/2236766
  • report
    https://bugzilla.redhat.com/2236774
  • report
    https://bugzilla.redhat.com/2236779
  • report
    https://bugzilla.redhat.com/2236784
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-2208.html