{"id":"CVE-2018-8784","aliases":["DEBIAN-CVE-2018-8784","EUVD-2018-20393","GHSA-9392-mf3x-x7wh","MGASA-2019-0012","SUSE-SU-2019:0134-1","SUSE-SU-2019:0539-1","SUSE-SU-2020:2272-1","UBUNTU-CVE-2018-8784","USN-3845-1","openSUSE-SU-2019:0325-1","openSUSE-SU-2024:10768-1"],"status":"published","title":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function...","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07293,"percentile":0.94401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2018-11-29T00:00:00Z","modified":"2026-10-23T18:03:09Z","fixes":[{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.0.0~git20181120.1.e21b72c95+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","fixed_in":["2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git20181120.1.e21b72c95+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-0.rc4.1.mga6"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git.1463131968.4e66df7-12.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~rc4-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.20.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.20.1"}]}],"bundled":46},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"vinagre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-16.3.3"}]}],"bundled":46},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu1.2"}]}],"versions":["1.0.2-1ubuntu1","1.0.2-2ubuntu1","1.0.2-2ubuntu1.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-2.1"}]}],"bundled":42}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"check point software technologies ltd.","product":"freerdp"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"http://www.securityfocus.com/bid/106938","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3845-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/17c363a5162fd4dc77b1df54e48d7bd9bf6b3be7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8784"},{"url":"https://github.com/advisories/GHSA-9392-mf3x-x7wh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8784","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0012.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24074","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190134-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1085416","tags":["report"]},{"url":"https://bugzilla.suse.com/1087240","tags":["report"]},{"url":"https://bugzilla.suse.com/1104918","tags":["report"]},{"url":"https://bugzilla.suse.com/1116708","tags":["report"]},{"url":"https://bugzilla.suse.com/1117963","tags":["report"]},{"url":"https://bugzilla.suse.com/1117964","tags":["report"]},{"url":"https://bugzilla.suse.com/1117965","tags":["report"]},{"url":"https://bugzilla.suse.com/1117966","tags":["report"]},{"url":"https://bugzilla.suse.com/1117967","tags":["report"]},{"url":"https://bugzilla.suse.com/1120507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8789","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190539-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1103557","tags":["report"]},{"url":"https://bugzilla.suse.com/1112028","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202272-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1004108","tags":["report"]},{"url":"https://bugzilla.suse.com/1050699","tags":["report"]},{"url":"https://bugzilla.suse.com/1050704","tags":["report"]},{"url":"https://bugzilla.suse.com/1050708","tags":["report"]},{"url":"https://bugzilla.suse.com/1050711","tags":["report"]},{"url":"https://bugzilla.suse.com/1050712","tags":["report"]},{"url":"https://bugzilla.suse.com/1050714","tags":["report"]},{"url":"https://bugzilla.suse.com/1090677","tags":["report"]},{"url":"https://bugzilla.suse.com/1129193","tags":["report"]},{"url":"https://bugzilla.suse.com/1169679","tags":["report"]},{"url":"https://bugzilla.suse.com/1169748","tags":["report"]},{"url":"https://bugzilla.suse.com/1171441","tags":["report"]},{"url":"https://bugzilla.suse.com/1171443","tags":["report"]},{"url":"https://bugzilla.suse.com/1171444","tags":["report"]},{"url":"https://bugzilla.suse.com/1171445","tags":["report"]},{"url":"https://bugzilla.suse.com/1171446","tags":["report"]},{"url":"https://bugzilla.suse.com/1171447","tags":["report"]},{"url":"https://bugzilla.suse.com/1171674","tags":["report"]},{"url":"https://bugzilla.suse.com/1173247","tags":["report"]},{"url":"https://bugzilla.suse.com/1173605","tags":["report"]},{"url":"https://bugzilla.suse.com/1174200","tags":["report"]},{"url":"https://bugzilla.suse.com/1174321","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4033","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-8784","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3845-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8789","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MIETP2PR4Q4SATLCVO5M3PMEMOFCHU4C/#MIETP2PR4Q4SATLCVO5M3PMEMOFCHU4C","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17177","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-8784","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T17:00:00Z","modified":"2024-09-17T01:55:43.145Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:04.540365Z"}],"euvd":[{"id":"EUVD-2018-20393","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T17:00:00Z","modified":"2024-09-17T01:55:43Z","updated_at":"2026-11-03T00:28:45.29969Z"}],"ghsa":[{"id":"GHSA-9392-mf3x-x7wh","title":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function...","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2022-05-13T01:15:09Z","modified":"2023-02-01T05:04:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:10.892175Z"}],"nvd":[{"id":"CVE-2018-8784","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T18:29:00.803Z","modified":"2026-06-17T02:05:22.86Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-8784","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T18:29:00.803Z","modified":"2026-10-20T13:35:50.104680227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8784","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T18:29:00.803Z","modified":"2026-10-23T18:03:09.461532573Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-8784","description":"FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.","status":"published","published":"2018-11-29T00:00:00Z","modified":"2026-04-22T12:04:21.184434Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"MGASA-2019-0012","title":"Updated freerdp packages fix security vulnerabilities","description":"Eyal Itkin discovered FreeRDP incorrectly handled certain stream\nencodings. A malicious server could use this issue to cause FreeRDP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode (CVE-2018-8784, CVE-2018-8785).\n\nEyal Itkin discovered FreeRDP incorrectly handled bitmaps. A malicious\nserver could use this issue to cause FreeRDP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code (CVE-2018-8786,\nCVE-2018-8787).\n\nEyal Itkin discovered FreeRDP incorrectly handled certain stream\nencodings. A malicious server could use this issue to cause FreeRDP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode (CVE-2018-8788).\n\nEyal Itkin discovered FreeRDP incorrectly handled NTLM authentication. A\nmalicious server could use this issue to cause FreeRDP to crash,\nresulting in a denial of service, or possibly execute arbitrary code\n(CVE-2018-8789).\n","status":"published","published":"2019-01-05T18:30:16Z","modified":"2026-04-16T06:25:21.260109681Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0325-1","title":"Security update for freerdp","description":"This update for freerdp to version 2.0.0~rc4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)\n- CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965)\n- CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967)\n- CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966)\n- CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964)\n- CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963)\n- CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708)\n- CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507)\n\nOther issues:\n\n- Upgraded to version 2.0.0-rc4 (FATE#326739)\n- Security and stability improvements, including bsc#1103557 and bsc#1112028\n- gateway: multiple fixes and improvements\n- client/X11: support for rail (remote app) icons was added\n- The licensing code was re-worked: Per-device licenses are now saved on the\n  client and used on re-connect:        \n      WARNING: this is a change in FreeRDP behavior regarding licensing. If the old\n      behavior is required, or no licenses should be saved use the\n      new command line option +old-license (gh#/FreeRDP/FreeRDP#4979)\n- Improved order handling -  only orders that were enable  during capability exchange are accepted.\n      WARNING and NOTE: some servers do improperly send orders that weren't negotiated,\n      for such cases the new command line option /relax-order-checks was added to\n      disable the strict order checking. If connecting to xrdp the options\n      /relax-order-checks *and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926)\n- Fixed automount issues\n- Fixed several audio and microphone related issues\n- Fixed X11 Right-Ctrl ungrab feature\n- Fixed race condition in rdpsnd channel server.\n- Disabled SSE2 for ARM and powerpc\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:14:11Z","modified":"2026-02-04T03:42:10.458804Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10768-1","title":"freerdp-2.4.0-2.1 on GA media","description":"These are all security issues fixed in the freerdp-2.4.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:35.66086Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0134-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)\n- CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965)\n- CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967)\n- CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966)\n- CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964)\n- CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963)\n- CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708)\n- CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507)\n","status":"published","published":"2019-01-21T12:51:05Z","modified":"2026-02-04T03:08:53.306408Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0539-1","title":"Security update for freerdp","description":"This update for freerdp to version 2.0.0~rc4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-0886: Fix a remote code execution vulnerability (CredSSP) (bsc#1085416, bsc#1087240, bsc#1104918)\n- CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication module (bsc#1117965)\n- CVE-2018-8785: Fix a potential remote code execution vulnerability in the zgfx_decompress function (bsc#1117967)\n- CVE-2018-8786: Fix a potential remote code execution vulnerability in the update_read_bitmap_update function (bsc#1117966)\n- CVE-2018-8787: Fix a potential remote code execution vulnerability in the gdi_Bitmap_Decompress function (bsc#1117964)\n- CVE-2018-8788: Fix a potential remote code execution vulnerability in the nsc_rle_decode function (bsc#1117963)\n- CVE-2018-8784: Fix a potential remote code execution vulnerability in the zgfx_decompress_segment function (bsc#1116708)\n- CVE-2018-1000852: Fixed a remote memory access in the drdynvc_process_capability_request function (bsc#1120507)\n\nOther issues:\n\n- Upgraded to version 2.0.0-rc4 (FATE#326739)\n- Security and stability improvements, including bsc#1103557 and bsc#1112028\n- gateway: multiple fixes and improvements\n- client/X11: support for rail (remote app) icons was added\n- The licensing code was re-worked: Per-device licenses are now saved on the\n  client and used on re-connect:        \n      WARNING: this is a change in FreeRDP behavior regarding licensing. If the old\n      behavior is required, or no licenses should be saved use the\n      new command line option +old-license (gh#/FreeRDP/FreeRDP#4979)\n- Improved order handling -  only orders that were enable  during capability exchange are accepted.\n      WARNING and NOTE: some servers do improperly send orders that weren't negotiated,\n      for such cases the new command line option /relax-order-checks was added to\n      disable the strict order checking. If connecting to xrdp the options\n      /relax-order-checks *and* +glyph-cache are required. (gh#/FreeRDP/FreeRDP#4926)\n- Fixed automount issues\n- Fixed several audio and microphone related issues\n- Fixed X11 Right-Ctrl ungrab feature\n- Fixed race condition in rdpsnd channel server.\n- Disabled SSE2 for ARM and powerpc\n","status":"published","published":"2019-03-04T16:42:27Z","modified":"2026-02-04T02:27:52.465518Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2020:2272-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nfreerdp was updated to version 2.1.2 (bsc#1171441,bsc#1173247 and jsc#ECO-2006):\n\n- CVE-2020-11017: Fixed a double free which could have denied the server's service.\n- CVE-2020-11018: Fixed an out of bounds read which a malicious clients could have triggered.\n- CVE-2020-11019: Fixed an issue which could have led to denial of service if logger was set to 'WLOG_TRACE'.\n- CVE-2020-11038: Fixed a buffer overflow when /video redirection was used.\n- CVE-2020-11039: Fixed an issue which could have allowed arbitrary memory read and write when USB redirection was enabled.\n- CVE-2020-11040: Fixed an out of bounds data read in clear_decompress_subcode_rlex.\n- CVE-2020-11041: Fixed an issue with the configuration for sound backend which could have led to server's denial of service.\n- CVE-2020-11043: Fixed an out of bounds read in rfx_process_message_tileset.\n- CVE-2020-11085: Fixed an out of bounds read in cliprdr_read_format_list.\n- CVE-2020-11086: Fixed an out of bounds read in ntlm_read_ntlm_v2_client_challenge.\n- CVE-2020-11087: Fixed an out of bounds read in ntlm_read_AuthenticateMessage.\n- CVE-2020-11088: Fixed an out of bounds read in ntlm_read_NegotiateMessage.\n- CVE-2020-11089: Fixed an out of bounds read in irp function family.\n- CVE-2020-11095: Fixed a global out of bounds read in update_recv_primary_order.\n- CVE-2020-11096: Fixed a global out of bounds read in update_read_cache_bitmap_v3_order.\n- CVE-2020-11097: Fixed an out of bounds read in ntlm_av_pair_get.\n- CVE-2020-11098: Fixed an out of bounds read in glyph_cache_put.\n- CVE-2020-11099: Fixed an out of bounds Read in license_read_new_or_upgrade_license_packet.\n- CVE-2020-11521: Fixed an out of bounds write in planar.c (bsc#1171443).\n- CVE-2020-11522: Fixed an out of bounds read in gdi.c (bsc#1171444).\n- CVE-2020-11523: Fixed an integer overflow in region.c (bsc#1171445).\n- CVE-2020-11524: Fixed an out of bounds write in interleaved.c (bsc#1171446).\n- CVE-2020-11525: Fixed an out of bounds read in bitmap.c (bsc#1171447).\n- CVE-2020-11526: Fixed an out of bounds read in update_recv_secondary_order (bsc#1171674).\n- CVE-2020-13396: Fixed an Read in ntlm_read_ChallengeMessage.\n- CVE-2020-13397: Fixed an out of bounds read in security_fips_decrypt due to uninitialized value.\n- CVE-2020-13398: Fixed an out of bounds write in crypto_rsa_common.\n- CVE-2020-4030: Fixed an out of bounds read in `TrioParse`.\n- CVE-2020-4031: Fixed a use after free in gdi_SelectObject.\n- CVE-2020-4032: Fixed an integer casting in `update_recv_secondary_order`.\n- CVE-2020-4033: Fixed an out of bound read in RLEDECOMPRESS.\n- Fixed an issue where freerdp failed with -fno-common (bsc#1169748).\n- Fixed an issue where USB redirection with FreeRDP was not working (bsc#1169679).\n- Fixed an issue where freerdp could not start (bsc#1129193).\n- Fixed an issue where copy and paste between remote host was transforming text to chinese (bsc#1004108).\n- Added pulse support (bsc#1090677).\n\nAdditionally, the following issue was fixed:\n\n- CVE-2020-15103: Fix integer overflow due to missing input sanitation in rdpegfx channel (bsc#1174321).\n","status":"published","published":"2020-08-18T14:44:51Z","modified":"2026-02-04T02:32:54.178289Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-3845-1","title":"freerdp, freerdp2 vulnerabilities","description":"Eyal Itkin discovered FreeRDP incorrectly handled certain stream encodings.  A\nmalicious server could use this issue to cause FreeRDP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only applies\nto Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-8784, CVE-2018-8785)\n\nEyal Itkin discovered FreeRDP incorrectly handled bitmaps.  A malicious server\ncould use this issue to cause FreeRDP to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2018-8786, CVE-2018-8787)\n\nEyal Itkin discovered FreeRDP incorrectly handled certain stream encodings.  A\nmalicious server could use this issue to cause FreeRDP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only applies\nto Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-8788)\n\nEyal Itkin discovered FreeRDP incorrectly handled NTLM authentication.  A\nmalicious server could use this issue to cause FreeRDP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. This issue only applies\nto Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-8789)\n","status":"published","published":"2018-12-12T11:52:38Z","modified":"2026-04-22T09:52:15.317295Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}