Improper Validation of Array Index Affecting vinagre-debugsource package, versions <0:3.22.0-23.el8


Severity

Recommended
medium

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.07% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ROCKY8-VINAGREDEBUGSOURCE-3213003
  • published5 Jan 2023
  • disclosed29 May 2020

Introduced: 29 May 2020

CVE-2020-11041  (opens in a new tab)
CWE-129  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 vinagre-debugsource to version 0:3.22.0-23.el8 or higher.
This issue was patched in RLSA-2020:4647.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vinagre-debugsource package and not the vinagre-debugsource package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.

CVSS Scores

version 3.1