CVE-2018-8786

Publication date 29 November 2018

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

Status

Package Ubuntu Release Status
freerdp 19.04 disco Not in release
18.10 cosmic
Fixed 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1
18.04 LTS bionic
Fixed 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1
16.04 LTS xenial
Fixed 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3
14.04 LTS trusty
Fixed 1.0.2-2ubuntu1.2
freerdp2 19.04 disco
Fixed 2.0.0~git20181120.1.e21b72c95+dfsg1-1
18.10 cosmic
Fixed 2.0.0~git20180411.1.7a7b1802+dfsg1-2ubuntu0.1
18.04 LTS bionic
Fixed 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-3845-1
    • FreeRDP vulnerabilities
    • 12 December 2018

Other references