Skip to content
OpenAdvisories
High ELSA-2021-4619 2 CVEs

Important: freerdp security update (Oracle Linux 7)

Published Nov 11, 2021 · Updated Nov 11, 2021

Ecosystem: Oracle Linux

Summary

[2:2.2.0-5]
- Update: Refactored RPC gateway parser (rhbz#2017944)
+ fix issues discovered by Covscan

[2:2.2.0-4]
- Refactored RPC gateway parser (rhbz#2017944)

[2.1.1-3]
- Add checks for bitmap and glyph width/heigth values (rhbz#2017951)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 freerdp 0:2.1.1-5.el7_9
Oracle Linux · 7 freerdp-devel 0:2.1.1-5.el7_9
Oracle Linux · 7 freerdp-libs 0:2.1.1-5.el7_9
Oracle Linux · 7 libwinpr 0:2.1.1-5.el7_9
Oracle Linux · 7 libwinpr-devel 0:2.1.1-5.el7_9

Vulnerabilities 2

  • Medium 5.8
    CVE-2021-41159

    Improper client input validation for FreeRDP gateway connections allows to overwrite memory

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2021-41160 Public exploit

    Improper region checks in FreeRDP allow out of bound write to memory

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine