CVE-2014-0250: Integer Overflow
First published: Tue Aug 20 2013(Updated: )
client/X11/xf_graphics.c:xf_Pointer_New() performs a heap allocation this way: void xf_Pointer_New(rdpContext* context, rdpPointer* pointer) { XcursorImage ci; […] ci.width = pointer->width; ci.height = pointer->height; […] ci.pixels = (XcursorPixel*) malloc(ci.width * ci.height * 4); The width and height members are read from the wire. Both are 16 bit, but because of the multiplication with 4, the allocation still overflows (on 32 bit and 64 bit). xf_Bitmap_Decompress() appears to have a similar issue. These look very much like a trust boundary is crossed. Consequently, this is an embargoed security bug which has to be fixed in cooperation with upstream (which appears to be affected as well).
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreeRDP FreeRDP | =1.0.0 | |
| FreeRDP FreeRDP | =1.0.1 | |
| FreeRDP FreeRDP | =1.0.2 | |
| openSUSE openSUSE | =12.3 | |
| openSUSE openSUSE | =13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/FreeRDP/FreeRDP/issues/1657
- https://access.redhat.com/security/cve/CVE-2014-0250
- https://github.com/FreeRDP/FreeRDP/issues/1871
- https://bugzilla.redhat.com/show_bug.cgi?id=998934
- http://advisories.mageia.org/MGASA-2014-0287.html
- http://lists.opensuse.org/opensuse-updates/2014-07/msg00008.html
- http://seclists.org/oss-sec/2014/q2/365
- http://security.gentoo.org/glsa/glsa-201412-18.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:171
- http://www.securityfocus.com/bid/67670
- https://github.com/FreeRDP/FreeRDP/pull/1874
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-0250
- vendor/freerdp
- canonical/freerdp freerdp
- version/freerdp freerdp/1.0.0
- version/freerdp freerdp/1.0.1
- version/freerdp freerdp/1.0.2
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/12.3
- version/opensuse opensuse/13.1