Skip to content
OpenAdvisories
Medium RLSA-2021:1849 8 CVEs

Moderate: freerdp security, bug fix, and enhancement update

Published May 18, 2021 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

The following packages have been upgraded to a later upstream version: freerdp (2.2.0). (BZ#1881971)

Security Fix(es):

* freerdp: out of bounds read in TrioParse (CVE-2020-4030)

* freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)

* freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)

* freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)

* freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)

* freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)

* freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)

* freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Fixed packages 2

ReleasePackageFixed in
Rocky Linux · 8 freerdp 2:2.2.0-1.el8
Rocky Linux · 8 freerdp 2:2.2.0-10.el8

Vulnerabilities 8

  • Low 3.5
    CVE-2020-11095

    Global OOB read in update_recv_primary_order in FreeRDP

    In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11096

    Global OOB read in update_read_cache_bitmap_v3_order in FreeRDP

    In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11097 Public exploit

    OOB read in ntlm_av_pair_get in FreeRDP

    In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11098

    Out-of-bound read in glyph_cache_put in FreeRDP

    In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11099

    OOB Read in license_read_new_or_upgrade_license_packet in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-15103

    Integer Overflow in FreeRDP

    In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepte…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-4030

    OOB read in `TrioParse` in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.1
    CVE-2020-4033

    OOB Read in RLEDECOMPRESS in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854843
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854847
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854850
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854895
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854899
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1854910
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1858909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1881971