CVE-2022-39282: RDP client: Read of uninitialized memory with parallel port redirection
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using /parallel command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (/parallel command line switch) as a workaround.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-39282?
CVE-2022-39282 is a vulnerability in the FreeRDP remote desktop protocol library and clients, which could allow uninitialized data to be sent to the server.
How does CVE-2022-39282 affect FreeRDP?
CVE-2022-39282 affects FreeRDP based clients on Unix systems using the `/parallel` command line switch.
Are FreeRDP based server implementations affected by CVE-2022-39282?
No, FreeRDP based server implementations are not affected by CVE-2022-39282.
What is the severity of CVE-2022-39282?
CVE-2022-39282 has a severity rating of 7.5 (High).
How can I fix CVE-2022-39282?
To fix CVE-2022-39282, upgrade to FreeRDP version 2.8.1 or a higher version.