CVE-2020-11048: Out-of-bounds Read in FreeRDPrdp_read_flow_control_pdu
In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp2to a version that resolves this vulnerability.Fixed in 2.3.0+dfsg1-2+deb11u1Fixed in 2.3.0+dfsg1-2+deb11u3Fixed in 2.10.0+dfsg1-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11048?
The severity of CVE-2020-11048 is low.
How can I exploit CVE-2020-11048?
CVE-2020-11048 can only be used to abort a session, no data extraction is possible.
Which version of FreeRDP is affected by CVE-2020-11048?
FreeRDP versions after 1.0 and before 2.0.0 are affected by CVE-2020-11048.
How do I fix CVE-2020-11048?
Update FreeRDP to version 2.0.0 or higher to fix CVE-2020-11048.
Where can I find more information about CVE-2020-11048?
You can find more information about CVE-2020-11048 on the CVE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11048) and the FreeRDP GitHub page (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hv8w-f2hx-5gcv).