First published: Thu Aug 31 2023(Updated: )
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
Affected Software | Affected Version | How to fix |
---|---|---|
FreeRDP FreeRDP | <2.11.0 | |
FreeRDP FreeRDP | =3.0.0-beta1 | |
FreeRDP FreeRDP | =3.0.0-beta2 | |
Debian Debian Linux | =10.0 | |
Fedoraproject Fedora | =37 | |
Fedoraproject Fedora | =38 | |
Fedoraproject Fedora | =39 | |
ubuntu/freerdp2 | <2.2.0+dfsg1-0ubuntu0.18.04.4+ | 2.2.0+dfsg1-0ubuntu0.18.04.4+ |
ubuntu/freerdp2 | <2.2.0+dfsg1-0ubuntu0.20.04.5 | 2.2.0+dfsg1-0ubuntu0.20.04.5 |
ubuntu/freerdp2 | <2.6.1+dfsg1-3ubuntu2.4 | 2.6.1+dfsg1-3ubuntu2.4 |
ubuntu/freerdp2 | <2.10.0+dfsg1-1ubuntu0.2 | 2.10.0+dfsg1-1ubuntu0.2 |
ubuntu/freerdp2 | <2.10.0+dfsg1-1.1ubuntu1 | 2.10.0+dfsg1-1.1ubuntu1 |
ubuntu/freerdp2 | <2.11.0 | 2.11.0 |
redhat/freerdp | <2.11.0 | 2.11.0 |
redhat/freerdp | <3.0.0 | 3.0.0 |
debian/freerdp2 | <=2.3.0+dfsg1-2+deb11u1<=2.10.0+dfsg1-1 | 2.11.5+dfsg1-1 2.11.7+dfsg1-2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability CVE-2023-40188 is an Out-Of-Bounds Read vulnerability in the general_LumaToYUV444 function of FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP).
The severity of the CVE-2023-40188 vulnerability is critical, with a severity score of 9.1 out of 10.
Versions up to exclusive 2.11.0, 3.0.0-beta1, and 3.0.0-beta2 of FreeRDP are affected by the CVE-2023-40188 vulnerability.
To fix the CVE-2023-40188 vulnerability in FreeRDP, you should update to version 2.11.2+dfsg1-1 (for package-remedy from debian).
The CWE classification of CVE-2023-40188 is CWE-125: Out-of-bounds Read.