CVE-2020-11044: Double Free in FreeRDP
In FreeRDP greater than 1.2 and before 2.0.0, a double free in updatereadcachebitmapv3order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp2to a version that resolves this vulnerability.Fixed in 2.3.0+dfsg1-2+deb11u1Fixed in 2.3.0+dfsg1-2+deb11u3Fixed in 2.10.0+dfsg1-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is CVE-2020-11044?
CVE-2020-11044 is a vulnerability in FreeRDP that allows a double free in update_read_cache_bitmap_v3_order to crash the client application if corrupted data from a manipulated server is parsed.
How severe is CVE-2020-11044?
CVE-2020-11044 has a severity rating of 2.2 (low).
How can I fix CVE-2020-11044?
Update to FreeRDP version 2.0.0 or higher, which includes the patch for CVE-2020-11044.
Where can I find more information about CVE-2020-11044?
You can find more information about CVE-2020-11044 on the MITRE CVE website and the FreeRDP GitHub security advisory.
Is Ubuntu affected by CVE-2020-11044?
Yes, Ubuntu versions 18.04, 19.10, and 20.04 are affected by CVE-2020-11044.