CVE-2020-4030
Published: 22 June 2020
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
Notes
| Author | Note |
|---|---|
| mdeslaur | The freerdp package in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS does not build a server library. This is simply a client denial of service that has a negligible security impact. |
Priority
Medium
CVSS 3 base score: 6.5
Status
| Package | Release | Status |
|---|---|---|
|
freerdp Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needed
|
|
|
freerdp2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.0+dfsg1-0ubuntu0.18.04.1)
|
| eoan |
Ignored
(reached end-of-life)
|
|
| focal |
Released
(2.2.0+dfsg1-0ubuntu0.20.04.1)
|
|
| groovy |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| hirsute |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| impish |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| jammy |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27 |
||