CVE-2020-11041
Published: 29 May 2020
In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
Priority
Status
Package | Release | Status |
---|---|---|
freerdp Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(code not present)
|
|
freerdp2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.1.1+dfsg1-0ubuntu0.18.04.1)
|
eoan |
Released
(2.1.1+dfsg1-0ubuntu0.19.10.1)
|
|
focal |
Released
(2.1.1+dfsg1-0ubuntu0.20.04.1)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.1.1+dfsg1-1)
|
|
xenial |
Does not exist
|
|
Patches: upstream: https://github.com/FreeRDP/FreeRDP/commit/2215fef975b963b3995356c3583f0e87cd08ac6b |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 2.7 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | High |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | Low |
Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |