CVE-2020-11045: Out-of-bounds Read in FreeRDP
In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in updatereadbitmapdata that allows client memory to be read to an image buffer. The result displayed on screen as colour.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp2to a version that resolves this vulnerability.Fixed in 2.3.0+dfsg1-2+deb11u1Fixed in 2.3.0+dfsg1-2+deb11u3Fixed in 2.10.0+dfsg1-1 - Upgrade
Upgrade
redhat/freerdpto a version that resolves this vulnerability.Fixed in 2.0.0 - Upgrade
Upgrade
FreeRDP/FreeRDPto a version that resolves this vulnerability.Fixed in 2.0.0Patch GHSA-3x39-248q-f4q6
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11045?
The severity of CVE-2020-11045 is classified as medium, indicating potential impact on client memory security.
How do I fix CVE-2020-11045?
To fix CVE-2020-11045, ensure that you update FreeRDP to version 2.3.0+dfsg1-2+deb11u1 or later.
What versions of FreeRDP are affected by CVE-2020-11045?
CVE-2020-11045 affects FreeRDP versions after 1.0 and before 2.0.0.
Is CVE-2020-11045 present in Debian 9.0?
Yes, CVE-2020-11045 is present in Debian 9.0 if it is running an affected version of FreeRDP.
Can CVE-2020-11045 impact Ubuntu 20.04 users?
Yes, CVE-2020-11045 can impact Ubuntu 20.04 users if they are using a vulnerable version of FreeRDP.