CVE-2023-40186: IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP

Q: What is CVE-2023-40186?

CVE-2023-40186 is an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function of FreeRDP.

Q: Which software versions are affected by CVE-2023-40186?

Versions up to and excluding 2.11.0 of FreeRDP and version 3.0.0-beta1 and 3.0.0-beta2 of FreeRDP are affected by CVE-2023-40186.

Q: What is the severity rating of CVE-2023-40186?

CVE-2023-40186 has a severity rating of 9.8 (Critical).

Q: How can I fix CVE-2023-40186?

To fix CVE-2023-40186, update to FreeRDP version 2.11.2+dfsg1-1 or a later version as recommended by the vendor.

Q: Is there any additional information available about CVE-2023-40186?

Additional information about CVE-2023-40186 can be found at the following references: [link1], [link2], [link3].

Published Aug 31, 2023

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the gdiCreateSurface function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Affected Software

16 affected componentsFixes available

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.18.04.4+

2.2.0+dfsg1-0ubuntu0.18.04.4+

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.20.04.5

2.2.0+dfsg1-0ubuntu0.20.04.5

ubuntu/freerdp2<2.6.1+dfsg1-3ubuntu2.4

2.6.1+dfsg1-3ubuntu2.4

ubuntu/freerdp2<2.10.0+dfsg1-1ubuntu0.2

2.10.0+dfsg1-1ubuntu0.2

ubuntu/freerdp2<2.10.0+dfsg1-1.1ubuntu1

2.10.0+dfsg1-1.1ubuntu1

ubuntu/freerdp2<2.11.0

2.11.0

redhat/freerdp<2.11.0

2.11.0

redhat/freerdp<3.0.0

3.0.0

debian/freerdp2<=2.3.0+dfsg1-2+deb11u1, <=2.10.0+dfsg1-1

2.11.5+dfsg1-12.11.7+dfsg1-2

FreeRDP freerdp<2.11.0

FreeRDP freerdp=3.0.0-beta1

FreeRDP freerdp=3.0.0-beta2

Debian Debian Linux=10.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.18.04.4+
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.20.04.5
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.6.1+dfsg1-3ubuntu2.4
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1ubuntu0.2
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1.1ubuntu1
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.5+dfsg1-1Fixed in 2.11.7+dfsg1-2
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.0.0-beta3

Event History

Aug 31, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·09:13 PM

Data Sourced

via MITRE·09:13 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-6401-1

Frequently Asked Questions

What is CVE-2023-40186?

CVE-2023-40186 is an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function of FreeRDP.

Which software versions are affected by CVE-2023-40186?