Lucene search

K
mageiaGentoo FoundationMGASA-2022-0447
HistoryDec 07, 2022 - 2:32 a.m.

Updated freerdp packages fix security vulnerability

2022-12-0702:32:48
Gentoo Foundation
advisories.mageia.org
56
freerdp
security vulnerabilities
zgfx decoder
urbdrc channel
drive channel
malicious server
cve-2022-39316
cve-2022-39317
cve-2022-39318
cve-2022-39319
cve-2022-39320
cve-2022-39347
unix

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

54.9%

In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. (CVE-2022-39316) Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. (CVE-2022-39317) Affected versions of FreeRDP are missing input validation in ‘urbdrc’ channel. A malicious server can trick a FreeRDP based client to crash with division by zero. (CVE-2022-39318) Affected versions of FreeRDP are missing input length validation in the ‘urbdrc’ channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. (CVE-2022-39319) Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. (CVE-2022-39320) Affected versions of FreeRDP are missing path canonicalization and base path check for drive channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. (CVE-2022-39347)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchfreerdp< 2.2.0-1.4freerdp-2.2.0-1.4.mga8

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

54.9%