CVE-2023-39353: Missing offset validation leading to Out Of Bound Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the libfreerdp/codec/rfx.c file there is no offset validation in tile->quantIdxY, tile->quantIdxCb, and tile->quantIdxCr. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39353?
CVE-2023-39353 is a vulnerability in FreeRDP that allows an Out Of Bound Read due to missing offset validation.
What is the severity of CVE-2023-39353?
CVE-2023-39353 has a severity rating of 9.1 (critical).
How does CVE-2023-39353 affect FreeRDP?
CVE-2023-39353 affects versions up to and excluding 2.11.0 of FreeRDP, as well as version 3.0.0-beta1 and 3.0.0-beta2.
How can I fix CVE-2023-39353 in FreeRDP?
To fix CVE-2023-39353 in FreeRDP, update to version 2.11.2+dfsg1-1 or later.
Where can I find more information about CVE-2023-39353?
More information about CVE-2023-39353 can be found in the references provided: [GitHub Advisory](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg53-9j9h-3c8f), [Fedora Mailing List](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/).