Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
61,766 results · Feed
-
Medium 5.9
FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token
FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU…
-
Medium 5.3
FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP ser…
-
Medium 6.5
FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an…
-
Medium 4.3
FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload
FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX paylo…
-
Medium 4.3
FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request wi…
-
Medium 6.5
FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx chann…
-
Medium 4.3
FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumula…
-
Medium 6.5
FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without en…
-
Medium 4.3
FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet
FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before…
-
Medium 6.5
FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then s…
-
Medium 4.3
FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7F…
-
Medium 4.3
FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to …
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread…
-
Medium 4.3
FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion
FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsis…
-
Medium 6.5
FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder
FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowin…
-
Medium 6.5
FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder
FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion
FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65…
-
Medium 4.3
FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE…
-
High 7.4
FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a c…
-
Medium 4.3
FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway Response
FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed u…
-
Low 3.1
FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the r…
-
Medium 6.5
FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 byte…
-
Medium 4.3
FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 me…
-
High 7.5
FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipbo…
-
High 7.4
Out-of-bounds Write in NTPsec
An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-…
-
Low 3.7
Out-of-bounds Read in NTPsec
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleart…
-
High 8.1
tcp: Fix potential UAF in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk imm…
-
High 7.8
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleare…
-
Unscored —
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.
-
Unscored —
ntfs: fix resident conversion in ntfs_new_attr_flags
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated.
-
Unscored —
dm cache: fix issue with background work locking
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee th…
-
Unscored —
soc/tegra: pmc: Fix uninitialised clock rate
In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegra_pmc_enter_suspend_mode() function is being triggered because the early_pmc->rate variabl…
-
Unscored —
gpio: shared: gracefully handle no-device lookup of shared GPIOs
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no de…
-
Unscored —
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when runnin…
-
Unscored —
io_uring/io-wq: don't hide a link from cancellations
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks everywhere a request can be,…
-
Unscored —
io_uring/cancel: rearm local work wake up before sleep
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: rearm local work wake up before sleep io_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next io_req_local_work_add() wakes the cancelling task. The add that t…
-
Unscored —
io_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats that until the list is emp…
-
Unscored —
printk: Postpone kthread startup
In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during …
-
Unscored —
Drivers: hv: Avoid infinite retry loop in init_vp_index()
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocat…
-
Unscored —
pid_namespace: make zap_pid_ns_processes() freezable
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the…