CVE-2020-11018: Out of bound read in cliprdr_server_receive_capabilities in FreeRDP
In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/freerdpto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11018?
CVE-2020-11018 has a medium severity level due to the potential for resource exhaustion and memory issues.
How do I fix CVE-2020-11018?
To fix CVE-2020-11018, upgrade FreeRDP to version 2.1.0 or higher.
Which versions of FreeRDP are affected by CVE-2020-11018?
CVE-2020-11018 affects FreeRDP versions less than or equal to 2.0.0.
What are the potential risks associated with CVE-2020-11018?
The potential risks include memory allocation issues and the possibility of out-of-bounds read vulnerabilities.
Is CVE-2020-11018 fixed in any specific releases?
Yes, CVE-2020-11018 is fixed in FreeRDP version 2.1.0.