Integer overflow in FreeRDP - CVE-2020-15103

Vulnerability identifier: #VU32882

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15103

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow due to missing input sanitation in rdpegfx channel. A remote attacker can trick the victim to connect to a malicious server and perform a denial of service attack.

FreeRDP
freerdp (Alpine package)
freerdp (Red Hat package)
libfreerdp2-2 (Ubuntu package)
libfreerdp-server2-2 (Ubuntu package)
libfreerdp-client2-2 (Ubuntu package)
freerdp
libwinpr
libwinpr-devel
freerdp-libs
freerdp-debugsource
freerdp-devel
freerdp-help
freerdp-debuginfo
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Opensuse
Ubuntu
openEuler
Fedora

Install updates from vendor's website.

FreeRDP - update to 2.2.0
freerdp (Alpine package) - update to 2.2.0-r0
freerdp (Red Hat package) - update to 2.2.0-1.el8
libfreerdp2-2 (Ubuntu package) - addressed in versions 2.2.0+dfsg1-0ubuntu0.18.04.1, 2.2.0+dfsg1-0ubuntu0.20.04.1
libfreerdp-server2-2 (Ubuntu package) - addressed in versions 2.2.0+dfsg1-0ubuntu0.18.04.1, 2.2.0+dfsg1-0ubuntu0.20.04.1
libfreerdp-client2-2 (Ubuntu package) - addressed in versions 2.2.0+dfsg1-0ubuntu0.18.04.1, 2.2.0+dfsg1-0ubuntu0.20.04.1
freerdp - addressed in versions 2.2.0-1.fc31, 2.2.0-1.fc32, 2.2.0-4.fc33
libwinpr - update to 2.2.0-6
libwinpr-devel - update to 2.2.0-6
freerdp-libs - update to 2.2.0-6
freerdp - update to 2.2.0-6
freerdp-debugsource - update to 2.11.1-1
libwinpr-devel - update to 2.11.1-1
libwinpr - update to 2.11.1-1
freerdp-devel - update to 2.11.1-1
freerdp-help - update to 2.11.1-1
freerdp-debuginfo - update to 2.11.1-1
freerdp - update to 2.11.1-1

• https://github.com/FreeRDP/FreeRDP/blob/616af2d5b86dc24c7b3e89870dbcffd841d9a535/ChangeLog#L4
• https://github.com/FreeRDP/FreeRDP/pull/6382
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9

• Integer overflow in FreeRDP
• Integer overflow in freerdp (Alpine package)
• OpenSUSE Linux update for freerdp
• Red Hat Enterprise Linux 8 update for freerdp
• openEuler 20.03 LTS SP1 update for freerdp
• Anolis OS update for freerdp (Anolis OS 8.4)
• Ubuntu update for freerdp2
• Fedora 31 update for freerdp
• Fedora 32 update for freerdp
• Fedora 33 update for freerdp