CVE-2022-39282

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: clients using /parallel command line switch might read uninitialized data (CVE-2022-39282)

• freerdp: clients using the /video command line switch might read uninitialized data (CVE-2022-39283)

• freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)

• freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)

• freerdp: division by zero in urbdrc channel (CVE-2022-39318)

• freerdp: missing length validation in urbdrc channel (CVE-2022-39319)

• freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)

• freerdp: missing path sanitation with drive channel (CVE-2022-39347)

• freerdp: missing input length validation in drive channel (CVE-2022-41877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (/parallel command line switch) as a workaround.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: clients using /parallel command line switch might read uninitialized data (CVE-2022-39282)
• freerdp: clients using the /video command line switch might read uninitialized data (CVE-2022-39283)
• freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)
• freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)
• freerdp: division by zero in urbdrc channel (CVE-2022-39318)
• freerdp: missing length validation in urbdrc channel (CVE-2022-39319)
• freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)
• freerdp: missing path sanitation with drive channel (CVE-2022-39347)
• freerdp: missing input length validation in drive channel (CVE-2022-41877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: clients using /parallel command line switch might read uninitialized data (CVE-2022-39282)
• freerdp: clients using the /video command line switch might read uninitialized data (CVE-2022-39283)
• freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)
• freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)
• freerdp: division by zero in urbdrc channel (CVE-2022-39318)
• freerdp: missing length validation in urbdrc channel (CVE-2022-39319)
• freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)
• freerdp: missing path sanitation with drive channel (CVE-2022-39347)
• freerdp: missing input length validation in drive channel (CVE-2022-41877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2026-33985: fix information leak in ClearCodec glyph index decode; validate nWidth*nHeight for overflow and update glyphEntry->count only after a successful realloc so subsequent reads cannot expose adjacent heap memory
• CVE-2022-39283: fix missing length check in /video channel data handler; verify the stream contains cbSample bytes before using Stream_Pointer(), preventing decode of uninitialized data past the received payload
• CVE-2022-39282: fix length handling in /parallel driver; zero-initialize the read buffer with calloc and return only the bytes actually read from the port, preventing leakage of uninitialized client memory to the server

FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. (CVE-2022-39282)

All FreeRDP based clients when using the /video command line switch might read uninitialized data, decode it as audio/video and display the result. (CVE-2022-39283)

These are all security issues fixed in the freerdp-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

• CVE-2022-39282: Fix to init data read by /parallel command line switch. (bsc#1204258)
• CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)

This update for freerdp fixes the following issues:

• CVE-2022-39282: Fix to init data read by /parallel command line switch. (bsc#1204258)
• CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)

This update for freerdp fixes the following issues:

• CVE-2022-39282: Fix to init data read by /parallel command line switch. (bsc#1204258)
• CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)

It was discovered that FreeRDP incorrectly handled certain data lenghts. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-39282, CVE-2022-39283)

It was discovered that FreeRDP incorrectly handled certain data lenghts. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319, CVE-2022-39320)

It was discovered that FreeRDP incorrectly handled certain path checks. A malicious server could use this issue to cause FreeRDP clients to read files outside of the shared directory. (CVE-2022-39347)