p PatchFirst

CVE-2022-39319

CVE-2022-39319 · Missing length validation in urbdrc channel in FreeRDP

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

CVSS 4.6 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • freerdp

    Versions
    • < 2.9.0: Affected

    No fix published

  • freerdp2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.9.0+dfsg1-1

    Update to 2.9.0+dfsg1-1

  • freerdp Ubuntu:16.04:LTS

    Versions
    • 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1
    • 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2
    • 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
    • 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freerdp2 Ubuntu:18.04:LTS

    Versions
    • 2.0.0~git20170725.1.1648deb+dfsg1-1
    • 2.0.0~git20170725.1.1648deb+dfsg1-5
    • 2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1
    • 2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2
    • 2.0.0~git20170725.1.1648deb+dfsg1-6
    • 2.0.0~git20170725.1.1648deb+dfsg1-6build1
    • 2.0.0~git20170725.1.1648deb+dfsg1-7
    • 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1
    • 2.1.1+dfsg1-0ubuntu0.18.04.1
    • 2.2.0+dfsg1-0ubuntu0.18.04.1
    • 2.2.0+dfsg1-0ubuntu0.18.04.2
    • 2.2.0+dfsg1-0ubuntu0.18.04.3
    Affected ranges
    • ECOSYSTEM: < 2.2.0+dfsg1-0ubuntu0.18.04.4

    Update to 2.2.0+dfsg1-0ubuntu0.18.04.4

  • freerdp Ubuntu:18.04:LTS

    Versions
    • 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1
    • 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1
    • 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • freerdp2 Ubuntu:20.04:LTS

    Versions
    • 2.0.0~git20190204.1.2693389a+dfsg1-1
    • 2.0.0~git20190204.1.2693389a+dfsg1-2
    • 2.0.0~git20190204.1.2693389a+dfsg1-2build1
    • 2.0.0~git20190204.1.2693389a+dfsg1-2build2
    • 2.1.1+dfsg1-0ubuntu0.20.04.1
    • 2.2.0+dfsg1-0ubuntu0.20.04.1
    • 2.2.0+dfsg1-0ubuntu0.20.04.2
    • 2.2.0+dfsg1-0ubuntu0.20.04.3
    Affected ranges
    • ECOSYSTEM: < 2.2.0+dfsg1-0ubuntu0.20.04.4

    Update to 2.2.0+dfsg1-0ubuntu0.20.04.4

  • freerdp2 Ubuntu:22.04:LTS

    Versions
    • 2.3.0+dfsg1-2build1
    • 2.3.0+dfsg1-2ubuntu1
    • 2.3.0+dfsg1-2ubuntu2
    • 2.4.1+dfsg1-1
    • 2.4.1+dfsg1-1ubuntu1
    • 2.4.1+dfsg1-1ubuntu2
    • 2.5.0+dfsg1-1
    • 2.6.0+dfsg1-1
    • 2.6.1+dfsg1-1
    • 2.6.1+dfsg1-3
    • 2.6.1+dfsg1-3ubuntu1
    • 2.6.1+dfsg1-3ubuntu2
    • 2.6.1+dfsg1-3ubuntu2.1
    • 2.6.1+dfsg1-3ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 2.6.1+dfsg1-3ubuntu2.3

    Update to 2.6.1+dfsg1-3ubuntu2.3

Original sources

Check your server →