CVE-2023-40188: Out-Of-Bounds Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the generalLumaToYUV444 function. This Out-Of-Bounds Read occurs because processing is done on the in variable without checking if it contains data of sufficient length. Insufficient data for the in variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2023-40188?
The vulnerability CVE-2023-40188 is an Out-Of-Bounds Read vulnerability in the general_LumaToYUV444 function of FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP).
What is the severity of the CVE-2023-40188 vulnerability?
The severity of the CVE-2023-40188 vulnerability is critical, with a severity score of 9.1 out of 10.
Which versions of FreeRDP are affected by CVE-2023-40188?
Versions up to exclusive 2.11.0, 3.0.0-beta1, and 3.0.0-beta2 of FreeRDP are affected by the CVE-2023-40188 vulnerability.
How can I fix the CVE-2023-40188 vulnerability in FreeRDP?
To fix the CVE-2023-40188 vulnerability in FreeRDP, you should update to version 2.11.2+dfsg1-1 (for package-remedy from debian).
What is the CWE classification of CVE-2023-40188?
The CWE classification of CVE-2023-40188 is CWE-125: Out-of-bounds Read.