CVE-2020-11097
CVE-2020-11097 · OOB read in ntlm_av_pair_get in FreeRDP
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.
CVSS 3.5 · Low · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
freerdp
- Versions
- < 2.1.2: Affected
No fix published
freerdp2 Debian:12
- Affected ranges
- ECOSYSTEM: < 2.1.2+dfsg1-1
Update to 2.1.2+dfsg1-1
freerdp Ubuntu:16.04:LTS
- Versions
- 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1
- 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2
- 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
- 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freerdp2 Ubuntu:18.04:LTS
- Versions
- 2.0.0~git20170725.1.1648deb+dfsg1-1
- 2.0.0~git20170725.1.1648deb+dfsg1-5
- 2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1
- 2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2
- 2.0.0~git20170725.1.1648deb+dfsg1-6
- 2.0.0~git20170725.1.1648deb+dfsg1-6build1
- 2.0.0~git20170725.1.1648deb+dfsg1-7
- 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1
- 2.1.1+dfsg1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: < 2.2.0+dfsg1-0ubuntu0.18.04.1
Update to 2.2.0+dfsg1-0ubuntu0.18.04.1
freerdp Ubuntu:18.04:LTS
- Versions
- 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1
- 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1
- 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freerdp2 Ubuntu:20.04:LTS
- Versions
- 2.0.0~git20190204.1.2693389a+dfsg1-1
- 2.0.0~git20190204.1.2693389a+dfsg1-2
- 2.0.0~git20190204.1.2693389a+dfsg1-2build1
- 2.0.0~git20190204.1.2693389a+dfsg1-2build2
- 2.1.1+dfsg1-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 2.2.0+dfsg1-0ubuntu0.20.04.1
Update to 2.2.0+dfsg1-0ubuntu0.20.04.1
Original sources
- http://www.freerdp.com/2020/06/22/2_1_2-released
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c8x2-c3c9-9r3f
- https://github.com/FreeRDP/FreeRDP/commit/58a3122250d54de3a944c487776bcd4d1da4721e
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
- https://usn.ubuntu.com/4481-1/
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11097