CVE-2020-4030
Published: 22 June 2020
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
Notes
| Author | Note |
|---|---|
| mdeslaur | The freerdp package in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS does not build a server library. This is simply a client denial of service that has a negligible security impact. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
freerdp Launchpad, Ubuntu, Debian |
impish |
Does not exist
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| xenial |
Needed
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| bionic |
Needed
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| mantic |
Does not exist
|
|
|
freerdp2 Launchpad, Ubuntu, Debian |
impish |
Not vulnerable
(2.2.0+dfsg1-1)
|
| groovy |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| bionic |
Released
(2.2.0+dfsg1-0ubuntu0.18.04.1)
|
|
| focal |
Released
(2.2.0+dfsg1-0ubuntu0.20.04.1)
|
|
| hirsute |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| eoan |
Ignored
(end of life)
|
|
| jammy |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| kinetic |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| lunar |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
| mantic |
Not vulnerable
(2.2.0+dfsg1-1)
|
|
|
Patches: upstream: https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |