Ubuntu.comUB:CVE-2024-22211CVE-2024-22211
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
29.9%
FreeRDP is a set of free and open source remote desktop protocol library
and clients. In affected versions an integer overflow in
freerdp_bitmap_planar_context_reset leads to heap-buffer overflow. This
affects FreeRDP based clients. FreeRDP based server implementations and
proxy are not affected. A malicious server could prepare a
RDPGFX_RESET_GRAPHICS_PDU to allocate too small buffers, possibly
triggering later out of bound read/write. Data extraction over network is
not possible, the buffers are used to display an image. This issue has been
addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there
are no know workarounds for this vulnerability.
Bugs
Notes
| Author | Note |
|---|---|
| Priority reason: FreeRDP developers have rated this as being a low severity issue |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | freerdp | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | freerdp | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | freerdp2 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | freerdp2 | < 2.6.1+dfsg1-0ubuntu0.20.04.1 | UNKNOWN |
| ubuntu | 22.04 | noarch | freerdp2 | < 2.6.1+dfsg1-3ubuntu2.6 | UNKNOWN |
| ubuntu | 23.10 | noarch | freerdp2 | < 2.10.0+dfsg1-1.1ubuntu1.2 | UNKNOWN |
| ubuntu | 24.04 | noarch | freerdp2 | < any | UNKNOWN |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
29.9%