Skip to content
OpenAdvisories
High ELSA-2021-4622 2 CVEs

Important: freerdp security update (Oracle Linux 8)

Published Nov 18, 2021 · Updated Nov 18, 2021

Ecosystem: Oracle Linux

Summary

[2:2.2.0-7]
- Updated: Refactored RPC gateway parser (rhbz#2017948)
+ fixed issues discovered by Covscan

[2:2.2.0-6]
- Refactored RPC gateway parser (rhbz#2017948)

[2:2.2.0-5]
- Revert: Refactored RPC gateway parser (rhbz#2017948)

[2:2.2.0-4]
- Refactored RPC gateway parser (rhbz#2017948)

[2:2.2.0-3]
- Add checks for bitmap and glyph width/heigth values (rhbz#2017955)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 8 freerdp 2:2.2.0-7.el8_5
Oracle Linux · 8 freerdp-devel 2:2.2.0-7.el8_5
Oracle Linux · 8 freerdp-libs 2:2.2.0-7.el8_5
Oracle Linux · 8 libwinpr 2:2.2.0-7.el8_5
Oracle Linux · 8 libwinpr-devel 2:2.2.0-7.el8_5

Vulnerabilities 2

  • Medium 5.8
    CVE-2021-41159

    Improper client input validation for FreeRDP gateway connections allows to overwrite memory

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2021-41160 Public exploit

    Improper region checks in FreeRDP allow out of bound write to memory

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphic…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine