CVE-2014-0250: Integer Overflow
client/X11/xfgraphics.c:xfPointerNew() performs a heap allocation this way:
void xfPointerNew(rdpContext context, rdpPointer pointer) { XcursorImage ci; […] ci.width = pointer->width; ci.height = pointer->height; […] ci.pixels = (XcursorPixel) malloc(ci.width ci.height 4);
The width and height members are read from the wire. Both are 16 bit, but because of the multiplication with 4, the allocation still overflows (on 32 bit and 64 bit).
xfBitmapDecompress() appears to have a similar issue.
These look very much like a trust boundary is crossed. Consequently, this is an embargoed security bug which has to be fixed in cooperation with upstream (which appears to be affected as well).
Other sources
Multiple integer overflows in client/X11/xfgraphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xfPointerNew or (2) xfBitmapDecompress function, which causes an incorrect amount of memory to be allocated.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0250?
CVE-2014-0250 has a moderate severity rating, impacting the stability and security of affected applications.
How do I fix CVE-2014-0250?
To fix CVE-2014-0250, upgrade FreeRDP to versions 1.0.3 or later, or apply any available security patches.
What are the affected versions for CVE-2014-0250?
CVE-2014-0250 affects FreeRDP versions 1.0.0, 1.0.1, and 1.0.2 as well as openSUSE versions 12.3 and 13.1.
What kind of vulnerability is CVE-2014-0250?
CVE-2014-0250 is related to memory management issues due to improper heap allocation.
Is CVE-2014-0250 present in my FreeRDP installation?
You can determine if CVE-2014-0250 is present by checking your FreeRDP version against the affected versions list.