CVE-2020-11047: Out-of-bounds Read in FreeRDP
In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetectrecvbandwidthmeasureresults. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11047?
CVE-2020-11047 has a CVSS score that indicates a medium severity due to its potential for memory disclosure.
How do I fix CVE-2020-11047?
To fix CVE-2020-11047, upgrade FreeRDP to version 2.3.0+dfsg1-2+deb11u1 or later.
Which versions of FreeRDP are affected by CVE-2020-11047?
CVE-2020-11047 affects FreeRDP versions after 1.1 and before 2.0.0.
What impact does CVE-2020-11047 have on a system?
CVE-2020-11047 allows a malicious server to read up to 8 bytes of client memory, potentially leading to sensitive information exposure.
Is CVE-2020-11047 present in Ubuntu releases?
Yes, CVE-2020-11047 is present in certain versions of Ubuntu Linux, including 18.04, 19.10, and 20.04.