CVE-2020-15103
Low
Description
In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto
SeverityLow
CVSS3.5
Exploit probability—
Product
Freerdp
PublishedJul 27, 2020
First seenJul 27, 2020
Weakness typeCWE-680CWE-680
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freerdp freerdp | v ≤ 2.1.2 | — |
| fedoraproject fedora | 31, 32 | — |
| opensuse leap | 15.1 | — |
| canonical ubuntu_linux | 18.04, 20.04 | — |
| debian debian_linux | 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.