Summary
[2:3.10.3-5.2]
- Backport several CVE fixes
Resolves: RHEL-147912, RHEL-148815, RHEL-148859, RHEL-148892, RHEL-148973
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | freerdp | 2:3.10.3-5.el10_1.2 |
| Oracle Linux · 10 | freerdp-devel | 2:3.10.3-5.el10_1.2 |
| Oracle Linux · 10 | freerdp-libs | 2:3.10.3-5.el10_1.2 |
| Oracle Linux · 10 | freerdp-server | 2:3.10.3-5.el10_1.2 |
| Oracle Linux · 10 | libwinpr | 2:3.10.3-5.el10_1.2 |
| Oracle Linux · 10 | libwinpr-devel | 2:3.10.3-5.el10_1.2 |
Vulnerabilities 5
-
High 8.7
FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fix…
-
Medium 6.8
FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow i…
-
Medium 5.6
FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
-
Medium 5.6
FreeRDP has a global-buffer-overflow in crypto_base64_decode
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is …
-
Medium 5.6
FreeRDP has a heap-buffer-overflow in urb_select_configuration
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing …