Integer overflow in Freerdp
CVE-2020-11038
In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
EPSS: 0.013 (68.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L.
Affected products
- Freerdp — versions <= 2.0.0
- Debian Debian_linux — versions 10.0
- Opensuse Leap — versions 15.1
Weakness classification (CWE)
References
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (vendor-advisory, Mailing List, Third Party Advisory)
- security-advisories@github.com (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-11038?
- CVE-2020-11038 is a medium-severity vulnerability in Freerdp, classified under Integer Overflow to Buffer Overflow. CVSS score: 6.9/10. Published 2020-05-29.
- How severe is CVE-2020-11038?
- Medium severity. CVSS v3 base score is 6.9 out of 10.