Use of Uninitialized Resource Affecting freerdp package, versions <2.4.0-150400.3.9.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES154-FREERDP-3123570
- published 17 Nov 2022
- disclosed 15 Nov 2022
Introduced: 15 Nov 2022
CVE-2022-39283 Open this link in a new tabHow to fix?
Upgrade SLES:15.4 freerdp to version 2.4.0-150400.3.9.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream freerdp package and not the freerdp package as distributed by SLES.
See How to fix? for SLES:15.4 relevant fixed versions and status.
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the /video command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the /video switch.
References
- https://www.suse.com/security/cve/CVE-2022-39283.html
- https://bugzilla.suse.com/1204257
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh
- https://security.gentoo.org/glsa/202210-24
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/
- https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html