Integer Overflow or Wraparound Affecting libwinpr package, versions <0:2.1.1-2.el7
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-LIBWINPR-1529401
- published 26 Jul 2021
- disclosed 9 Apr 2020
How to fix?
Upgrade RHEL:7 libwinpr to version 0:2.1.1-2.el7 or higher.
This issue was patched in RHSA-2020:4031.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libwinpr package and not the libwinpr package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h25x-cqr6-fp6g
- https://access.redhat.com/security/cve/CVE-2020-11038
- https://access.redhat.com/errata/RHSA-2020:4031
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html