FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9092 advisory.

    - Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,       CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,       CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9092 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset     (CVE-2024-22211)

    * freerdp: out-of-bounds read in ncrush_decompress (CVE-2024-32459)

    * freerdp: OutOfBound Read in interleaved_decompress (CVE-2024-32460)

    * freerdp: Integer overflow & OutOfBound Write in clear_decompress_residual_data (CVE-2024-32039)

    * freerdp: integer underflow in nsc_rle_decode (CVE-2024-32040)

    * freerdp: OutOfBound Read in zgfx_decompress_segment (CVE-2024-32041)

    * freerdp: OutOfBound Read in planar_skip_plane_rle (CVE-2024-32458)

    * freerdp: out-of-bounds read (CVE-2024-32662)

    * FreeRDP: ExtractRunLengthRegular* out of bound read (CVE-2024-32658)

    * freerdp: zgfx_decompress out of memory (CVE-2024-32660)

    * freerdp: freerdp_image_copy out of bound read (CVE-2024-32659)

    * freerdp: rdp_write_logon_info_v1 NULL access (CVE-2024-32661)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability.(CVE-2024-22211)

Tenable has extracted the preceding description block directly from the EulerOS freerdp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2631-1 advisory.

    - CVE-2024-22211: Fixed integer overflow in `freerdp_bitmap_planar_context_reset` that could lead to heap-     buffer overflow (bsc#1219049)
    - CVE-2024-32658: Fixed out-of-bounds read in Interleaved RLE Bitmap Codec in FreeRDP based clients     (bsc#1223353)
    - CVE-2024-32659: Fixed out-of-bounds read if `((nWidth == 0) and (nHeight == 0))` (bsc#1223346)
    - CVE-2024-32660: Fixed client crash via invalid huge allocation size (bsc#1223347)
    - CVE-2024-32661: Fixed client NULL pointer dereference (bsc#1223348)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset (CVE-2024-22211)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with     default compilation flags). When an insufficient blockLen is provided, and proper length validation is not     performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-39350)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2537 advisory.

    2024-06-06: CVE-2024-32660 was added to this advisory.

    FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

    Integer overflow & OutOfBound Write in clear_decompress_residual_data

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32039)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`). (CVE-2024-32040)

    OutOfBound Read in zgfx_decompress_segment

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32041)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    (CVE-2024-32458)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available. (CVE-2024-32459)

    OutOfBound Read in interleaved_decompress

    NOTE: https://www.freerdp.com/2024/04/17/2_11_6-release (CVE-2024-32460)

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available. (CVE-2024-32659)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6749-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain context resets. If a user were tricked into     connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-22211)

    Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were     tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to     crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-32039,     CVE-2024-32040)

    Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were     tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause     FreeRDP to crash, resulting in a denial of service. (CVE-2024-32041, CVE-2024-32458, CVE-2024-32460)

    Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker     could possibly use this issue to cause FreeRDP clients and servers to crash, resulting in a denial of     service. (CVE-2024-32459)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0649-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0648-1 advisory.

  - FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions     an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects     FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server     could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out     of bound read/write. Data extraction over network is not possible, the buffers are used to display an     image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are     no know workarounds for this vulnerability. (CVE-2024-22211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f294ddb7fb advisory.

    Update to 2.11.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-01689e51e5 advisory.

    Update to 2.11.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211551	Oracle Linux 9 : freerdp (ELSA-2024-9092)	Nessus	Oracle Linux Local Security Checks	critical
210790	RHEL 9 : freerdp (RHSA-2024:9092)	Nessus	Red Hat Local Security Checks	critical
207631	EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2024-2465)	Nessus	Huawei Local Security Checks	critical
204882	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : freerdp (SUSE-SU-2024:2631-1)	Nessus	SuSE Local Security Checks	critical
202965	EulerOS 2.0 SP8 : freerdp (EulerOS-SA-2024-2027)	Nessus	Huawei Local Security Checks	critical
199366	RHEL 8 : freerdp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
197113	Amazon Linux 2 : freerdp (ALAS-2024-2537)	Nessus	Amazon Linux Local Security Checks	critical
195721	RHEL 7 : freerdp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195673	RHEL 6 : freerdp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
193871	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : FreeRDP vulnerabilities (USN-6749-1)	Nessus	Ubuntu Local Security Checks	critical
191134	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : freerdp (SUSE-SU-2024:0649-1)	Nessus	SuSE Local Security Checks	critical
191132	SUSE SLED12 / SLES12 Security Update : freerdp (SUSE-SU-2024:0648-1)	Nessus	SuSE Local Security Checks	critical
190643	Fedora 38 : freerdp (2024-f294ddb7fb)	Nessus	Fedora Local Security Checks	critical
190637	Fedora 39 : freerdp (2024-01689e51e5)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-22211

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical