Summary
[2.1.1-5.0.13]
- Backport fix for CVE-2026-55192 [Orabug: 40040632]
- Backport fix for CVE-2026-55194 [Orabug: 40040632]
[2.1.1-5.0.11]
- Backport fix for CVE-2026-64624 [Orabug: 39964800]
- Backport fix for CVE-2026-67299 [Orabug: 39964800]
- Backport fix for CVE-2026-68580 [Orabug: 39964800]
[2.1.1-5.0.9]
- Fixed CVE-2026-25952 CVE-2026-26986 CVE-2026-27951 CVE-2026-29775
CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33985
[Orabug: 39440279]
[2.1.1-5.0.7]
- Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732
CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679
CVE-2026-24684 CVE-2026-31806 [Orabug: 39272429]
[2.1.1-5.0.5]
- Fixed CVE-2026-26955 CVE-2026-26956 [Orabug: 39189643]
[2:2.2.0-5.0.3]
- Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086]
[2:2.2.0-5.0.1]
- fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533
CVE-2026-23884 [Orabug: 38971897]
[2:2.2.0-5]
- Update: Refactored RPC gateway parser (rhbz#2017944)
+ fix issues discovered by Covscan
[2:2.2.0-4]
- Refactored RPC gateway parser (rhbz#2017944)
[2.1.1-3]
- Add checks for bitmap and glyph width/heigth values (rhbz#2017951)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | freerdp | 0:2.1.1-5.0.13.el7_9 |
| Oracle Linux · 7 | freerdp-devel | 0:2.1.1-5.0.13.el7_9 |
| Oracle Linux · 7 | freerdp-libs | 0:2.1.1-5.0.13.el7_9 |
| Oracle Linux · 7 | libwinpr | 0:2.1.1-5.0.13.el7_9 |
| Oracle Linux · 7 | libwinpr-devel | 0:2.1.1-5.0.13.el7_9 |
Vulnerabilities 7
-
High 8.7
FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual…
-
High 7.5
FreeRDP before 3.29.0 Denial of Service via smartcard cache
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, att…
-
High 7.5
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by read…
-
High 7.5
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c. When handling a GLYPH_FRAGMENT_ADD update, the code reads a one-byte server-cont…
-
High 7.5
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow
FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from t…
-
High 7.5
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled (e.g., xfreerdp /async-update), update_message_PolygonSC() and update_messa…
-
High 7.2
FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate re…