Out-of-bounds Write Affecting freerdp-devel package, versions *


Severity

Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.42% (75th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL6-FREERDPDEVEL-5884616
  • published6 Sept 2023
  • disclosed1 Sept 2023

Introduced: 1 Sep 2023

CVE-2023-40567  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:6 freerdp-devel.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freerdp-devel package and not the freerdp-devel package as distributed by RHEL. See How to fix? for RHEL:6 relevant fixed versions and status.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the clear_decompress_bands_data function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.

CVSS Scores

version 3.1