{"id":"CVE-2022-39282","aliases":["ALSA-2023:2326","ALSA-2023:2851","CLSA-2026-1777663444","DEBIAN-CVE-2022-39282","DLA-3654-1","DLA-4053-1","EUVD-2022-41784","GHSA-c45q-wcpg-mxjq","MGASA-2022-0437","OESA-2022-2018","RHSA-2023:2326","RHSA-2023:2851","RLSA-2023:2851","SUSE-SU-2022:3982-1","SUSE-SU-2022:3983-1","SUSE-SU-2022:3984-1","UBUNTU-CVE-2022-39282","USN-5734-1","openSUSE-SU-2024:12515-1"],"status":"published","title":"RDP client: Read of uninitialized memory with parallel port redirection","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01102,"percentile":0.65949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2022-10-12T00:00:00Z","modified":"2026-11-03T08:02:26Z","fixes":[{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.8.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.20.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-3ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els20"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els20"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els20"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els20"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els20"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb10u4"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2~bpo10+1","2.1.1+dfsg1-1","2.1.2+dfsg1-1","2.1.2+dfsg1-2","2.2.0+dfsg1-1","2.2.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-1","2.3.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb10u3"],"bundled":9},{"source":"osv","ecosystem":"Debian:11","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb11u2"}]}],"versions":["2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.3.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.1-5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.0-10.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-150200.15.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.4"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.4"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.3"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.4"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.4"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.3"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq","tags":["x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://security.gentoo.org/glsa/202210-24","tags":["vendor-advisory","x_transferred","Issue Tracking","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2326","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39283","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39316","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39317","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39318","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39319","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39320","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-39347","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41877","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134713","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134717","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143642","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143643","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143644","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143645","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143646","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143647","tags":["report"]},{"url":"https://bugzilla.redhat.com/2143648","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2326.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2851","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2851.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777663444.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39282.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39282","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-39282","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0437.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31136","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-November/012920.html","tags":["web"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh","tags":["advisory","article"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJA3DXXYKZSQPM7VF5GX343WBGCGAPAH/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39283","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143648","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2326.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39282","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39283","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39316","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39317","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39318","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39319","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39320","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39347","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41877","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2851.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2851","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223982-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204257","tags":["report"]},{"url":"https://bugzilla.suse.com/1204258","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39283","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223983-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223984-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39282","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5734-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-39283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39347","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-39282","title":"RDP client: Read of uninitialized memory with parallel port redirection","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2025-11-03T20:34:55.91Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-41784","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2025-11-03T20:34:55Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"nvd":[{"id":"CVE-2022-39282","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T23:15:09.417Z","modified":"2026-06-17T04:58:03.907Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:07:29.52424Z"}],"osv":[{"id":"CVE-2022-39282","title":"RDP client: Read of uninitialized memory with parallel port redirection","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T00:00:00Z","modified":"2026-10-28T02:30:53.24017291Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-39282","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T23:15:09.417Z","modified":"2026-11-03T08:02:26.146427665Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-2018","title":"freerdp security update","description":"FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp.\r\n\r\nSecurity Fix(es):\r\n\r\nFreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.(CVE-2022-39283)\r\n\r\nFreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.(CVE-2022-39282)","status":"published","published":"2022-10-26T11:05:20Z","modified":"2026-08-18T01:17:20.078401496Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:2326","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2024-09-16T09:59:34Z","modified":"2026-06-27T10:16:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:2851","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2024-09-16T09:59:44Z","modified":"2026-06-27T10:17:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:2851","title":"Moderate: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)\n\n* freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)\n\n* freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)\n\n* freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)\n\n* freerdp: division by zero in urbdrc channel (CVE-2022-39318)\n\n* freerdp: missing length validation in urbdrc channel (CVE-2022-39319)\n\n* freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)\n\n* freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)\n\n* freerdp: missing input length validation in `drive` channel (CVE-2022-41877)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-06-25T12:01:05.792943Z","modified":"2026-06-25T12:30:04.275974952Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-39282","description":"FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.","status":"published","published":"2022-10-12T23:15:00Z","modified":"2026-04-22T13:27:36.004597Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"ALSA-2023:2326","title":"Moderate: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)\n* freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)\n* freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)\n* freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)\n* freerdp: division by zero in urbdrc channel (CVE-2022-39318)\n* freerdp: missing length validation in urbdrc channel (CVE-2022-39319)\n* freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)\n* freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)\n* freerdp: missing input length validation in `drive` channel (CVE-2022-41877)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:55.392282272Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:2851","title":"Moderate: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)\n* freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)\n* freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)\n* freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)\n* freerdp: division by zero in urbdrc channel (CVE-2022-39318)\n* freerdp: missing length validation in urbdrc channel (CVE-2022-39319)\n* freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)\n* freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)\n* freerdp: missing input length validation in `drive` channel (CVE-2022-41877)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:04.895389052Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1777663444","title":"freerdp: Fix of 3 CVEs","description":"- CVE-2026-33985: fix information leak in ClearCodec glyph index decode;\n  validate nWidth*nHeight for overflow and update glyphEntry-\u003ecount only\n  after a successful realloc so subsequent reads cannot expose adjacent\n  heap memory\n- CVE-2022-39283: fix missing length check in /video channel data handler;\n  verify the stream contains cbSample bytes before using Stream_Pointer(),\n  preventing decode of uninitialized data past the received payload\n- CVE-2022-39282: fix length handling in /parallel driver; zero-initialize\n  the read buffer with calloc and return only the bytes actually read from\n  the port, preventing leakage of uninitialized client memory to the server","status":"published","published":"2026-05-05T21:09:06Z","modified":"2026-10-21T10:47:51.703120961Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-3654-1","title":"freerdp2 - security update","status":"published","published":"2023-11-17T00:00:00Z","modified":"2026-03-09T01:20:39.038402Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4053-1","title":"freerdp2 - security update","status":"published","published":"2025-02-15T00:00:00Z","modified":"2026-03-09T01:19:24.57066Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0437","title":"Updated freerdp packages fix security vulnerability","description":"FreeRDP based clients on unix systems using `/parallel` command line\nswitch might read uninitialized data and send it to the server the client\nis currently connected to. (CVE-2022-39282)\n\nAll FreeRDP based clients when using the `/video` command line switch\nmight read uninitialized data, decode it as audio/video and display the\nresult. (CVE-2022-39283)\n","status":"published","published":"2022-11-24T22:21:24Z","modified":"2026-04-16T04:41:59.739791987Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12515-1","title":"freerdp-2.8.1-1.1 on GA media","description":"These are all security issues fixed in the freerdp-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:49.554966Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3982-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-39282: Fix to init data read by `/parallel` command line switch. (bsc#1204258)\n- CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)\n","status":"published","published":"2022-11-15T10:46:17Z","modified":"2026-02-04T03:25:17.516279Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3983-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-39282: Fix to init data read by `/parallel` command line switch. (bsc#1204258)\n- CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)\n","status":"published","published":"2022-11-15T10:46:41Z","modified":"2026-02-04T03:15:57.397489Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3984-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2022-39282: Fix to init data read by `/parallel` command line switch. (bsc#1204258)\n- CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. (bsc#1204257)\n","status":"published","published":"2022-11-15T10:46:58Z","modified":"2025-05-02T04:33:32.779755Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5734-1","title":"freerdp2 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled certain data lenghts. A\nmalicious server could use this issue to cause FreeRDP clients to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu\n22.04 LTS. (CVE-2022-39282, CVE-2022-39283)\n\nIt was discovered that FreeRDP incorrectly handled certain data lenghts. A\nmalicious server could use this issue to cause FreeRDP clients to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\n(CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,\nCVE-2022-39320)\n\nIt was discovered that FreeRDP incorrectly handled certain path checks. A\nmalicious server could use this issue to cause FreeRDP clients to read\nfiles outside of the shared directory. (CVE-2022-39347)\n","status":"published","published":"2022-11-22T13:48:33Z","modified":"2026-04-27T16:32:23.705649532Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}