Skip to content
OpenAdvisories
Low USN-4481-1 10 CVEs

freerdp2 vulnerabilities

Published Sep 1, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FreeRDP incorrectly handled certain memory
operations. A remote attacker could use this issue to cause FreeRDP to
crash, resulting in a denial of service, or possibly execute arbitrary
code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS freerdp2 2.2.0+dfsg1-0ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS freerdp2 2.2.0+dfsg1-0ubuntu0.20.04.1

Vulnerabilities 10

  • Low 3.5
    CVE-2020-11095

    Global OOB read in update_recv_primary_order in FreeRDP

    In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11096

    Global OOB read in update_read_cache_bitmap_v3_order in FreeRDP

    In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11097 Public exploit

    OOB read in ntlm_av_pair_get in FreeRDP

    In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11098

    Out-of-bound read in glyph_cache_put in FreeRDP

    In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-11099

    OOB Read in license_read_new_or_upgrade_license_packet in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-15103

    Integer Overflow in FreeRDP

    In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepte…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-4030

    OOB read in `TrioParse` in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.5
    CVE-2020-4031

    Use-After-Free in gdi_SelectObject in FreeRDP

    In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.1
    CVE-2020-4032

    Integer casting vulnerability in `update_recv_secondary_order` in FreeRDP

    In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine
  • Low 3.1
    CVE-2020-4033

    OOB Read in RLEDECOMPRESS in FreeRDP

    In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-4030
  • report
    https://ubuntu.com/security/CVE-2020-4031
  • report
    https://ubuntu.com/security/CVE-2020-4032
  • report
    https://ubuntu.com/security/CVE-2020-4033
  • report
    https://ubuntu.com/security/CVE-2020-11095
  • report
    https://ubuntu.com/security/CVE-2020-11096
  • report
    https://ubuntu.com/security/CVE-2020-11097
  • report
    https://ubuntu.com/security/CVE-2020-11098
  • report
    https://ubuntu.com/security/CVE-2020-11099
  • report
    https://ubuntu.com/security/CVE-2020-15103