CVE-2020-15103

FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.

Security Fix(es):

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a memcpy) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto(CVE-2020-15103)

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

The following packages have been upgraded to a later upstream version: freerdp (2.2.0). (BZ#1881971)

Security Fix(es):

• freerdp: out of bounds read in TrioParse (CVE-2020-4030)

• freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)

• freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)

• freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)

• freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)

• freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)

• freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)

• freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a memcpy) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

The following packages have been upgraded to a later upstream version: freerdp (2.2.0). (BZ#1881971)

Security Fix(es):

• freerdp: out of bounds read in TrioParse (CVE-2020-4030)

• freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)

• freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)

• freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)

• freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)

• freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)

• freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)

• freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for freerdp fixes the following issues:

• CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the freerdp-2.4.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

freerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006):

• CVE-2020-11017: Fixed a double free which could have denied the server's service.
• CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have triggered.
• CVE-2020-11019: Fixed an issue which could have led to denial of service if logger was set to 'WLOG_TRACE'.
• CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.
• CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory read and write when USB redirection was enabled.
• CVE-2020-11040: Fixed an out of bounds data read in clear_decompress_subcode_rlex.
• CVE-2020-11041: Fixed an issue with the configuration for sound backend which could have led to server's denial of service.
• CVE-2020-11043: Fixed an out of bounds read in rfx_process_message_tileset.
• CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.
• CVE-2020-11086: Fixed an out of bounds read in ntlm_read_ntlm_v2_client_challenge.
• CVE-2020-11087: Fixed an out of bounds read in ntlm_read_AuthenticateMessage.
• CVE-2020-11088: Fixed an out of bounds read in ntlm_read_NegotiateMessage.
• CVE-2020-11089: Fixed an out of bounds read in irp function family.
• CVE-2020-11095: Fixed a global out of bounds read in update_recv_primary_order.
• CVE-2020-11096: Fixed a global out of bounds read in update_read_cache_bitmap_v3_order.
• CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.
• CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.
• CVE-2020-11099: Fixed an out of bounds Read in license_read_new_or_upgrade_license_packet.
• CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).
• CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).
• CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).
• CVE-2020-11524: Fixed an out of bounds write in interleaved.c (bsc#1171446).
• CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).
• CVE-2020-11526: Fixed an out of bounds read in update_recv_secondary_order (bsc#1171674).
• CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.
• CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due to uninitialized value.
• CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.
• CVE-2020-4030: Fixed an out of bounds read in TrioParse.
• CVE-2020-4031: Fixed a use after free in gdi_SelectObject.
• CVE-2020-4032: Fixed an integer casting in update_recv_secondary_order.
• CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.
• Fixed an issue where freerdp failed with -fno-common (bsc#1169748).
• Fixed an issue where USB redirection with FreeRDP was not working (bsc#1169679).
• Fixed an issue where freerdp could not start (bsc#1129193).
• Fixed an issue where copy and paste between remote host was transforming text to chinese (bsc#1004108).
• Added pulse support (bsc#1090677).

Additionally, the following issue was fixed:

• CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).

This update for freerdp fixes the following issues:

• CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).

This update for freerdp fixes the following issues:

• CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).

It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.