CVE-2020-11043: Out-of-bounds Read in FreeRDP
In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfxprocessmessagetileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is CVE-2020-11043?
CVE-2020-11043 is a vulnerability in FreeRDP that allows an out-of-bounds read in the rfx_process_message_tileset function.
What is the severity of CVE-2020-11043?
The severity of CVE-2020-11043 is medium with a severity value of 2.7.
How does CVE-2020-11043 affect FreeRDP?
CVE-2020-11043 affects FreeRDP versions up to and including 2.0.0.
How can I fix CVE-2020-11043?
You can fix CVE-2020-11043 by updating FreeRDP to version 2.1.0 or later.
Where can I find more information about CVE-2020-11043?
You can find more information about CVE-2020-11043 at the following references: [http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html), [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5mr4-28w3-rc84](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5mr4-28w3-rc84), [https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html](https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html)