CVE-2020-11089 - Out-of-bound read in FreeRDP

Back Back to CVE browser

MEDIUM

Out-of-bound read in FreeRDP

Published May 29, 2020

5.5

MEDIUM

CVSS 3.1

EPSS 1.15%

Description

In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.

Affected products

Vendor FreeRDP Product FreeRDP Default
n/a
- Version
  < 2.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FreeRDP

n/a

Version	Status	Constraints
< 2.1.0	affected	-

Red Hat Enterprise Linux 7

freerdp-0:2.1.1-2.el7

Fixed · RHSA-2020:4031
Red Hat Enterprise Linux 8

freerdp-2:2.1.1-1.el8

Fixed · RHSA-2020:4647
Red Hat Enterprise Linux 8

vinagre-0:3.22.0-23.el8

Fixed · RHSA-2020:4647
Red Hat Enterprise Linux 6

freerdp

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	freerdp-0:2.1.1-2.el7	Fixed	RHSA-2020:4031
Red Hat Enterprise Linux 8	freerdp-2:2.1.1-1.el8	Fixed	RHSA-2020:4647
Red Hat Enterprise Linux 8	vinagre-0:3.22.0-23.el8	Fixed	RHSA-2020:4647
Red Hat Enterprise Linux 6	freerdp	Out of support scope	n/a

Remediation

Red Hat mitigation

The vulnerability is associated with the use of the command line options: /drive, +multitouch, /paralell, /printer, and /servial. To mitigate this vulnerability, do not use these commands.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (9)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-11089
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1844184
Issue Tracking
https://github.com/FreeRDP/FreeRDP/commit/6b485b146a1b9d6ce72dfd7b5f36456c166e7a16
PatchThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/795842f4096501fcefc1a7f535ccc8132feb31d7
PatchThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hfc7-c5gv-8c2h
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
mailing-listMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-11089
https://www.cve.org/CVERecord?id=CVE-2020-11089

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html		vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-11089		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1844184		Issue Tracking
https://github.com/FreeRDP/FreeRDP/commit/6b485b146a1b9d6ce72dfd7b5f36456c166e7a16		PatchThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/795842f4096501fcefc1a7f535ccc8132feb31d7		PatchThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hfc7-c5gv-8c2h		Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html		mailing-listMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-11089
https://www.cve.org/CVERecord?id=CVE-2020-11089