NetSight
IP …
medium5.9

CVE-2023-39354

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

Impact

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffected versions
FreerdpFreerdp
before 2.11.0
Version 3.0.0
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 37, 38, 39

Weakness classification

CWE-125

References