Summary
[2:2.11.7-11]
- Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299,
CVE-2026-68580)
Resolves: RHEL-213173, RHEL-222796, RHEL-222972, RHEL-223606
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | freerdp | 2:2.11.7-11.el8_10 |
| Oracle Linux · 8 | freerdp-devel | 2:2.11.7-11.el8_10 |
| Oracle Linux · 8 | freerdp-libs | 2:2.11.7-11.el8_10 |
| Oracle Linux · 8 | libwinpr | 2:2.11.7-11.el8_10 |
| Oracle Linux · 8 | libwinpr-devel | 2:2.11.7-11.el8_10 |
Vulnerabilities 4
-
Critical 9.8
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an H…
-
High 7.8
FreeRDP RDP File Parser Remote Code Execution via CLI Options
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to exec…
-
High 7.5
FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In update_message_WindowIcon() a shallow CopyMemory() overwrites a freshly allo…
-
High 7.5
FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malic…