Vulnerability CVE-2024-32460: Information
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
Published: April 23, 2024
Modified: April 23, 2024
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
freerdp | sisyphus | 2.11.6-alt1 | 2.11.7-alt1.1 | ALT-PU-2024-6814-1 | 345418 | Fixed |
freerdp | sisyphus_e2k | 2.11.7-alt1.1 | 2.11.7-alt1.1 | ALT-PU-2024-7151-1 | - | Fixed |
freerdp | sisyphus_riscv64 | 2.11.6-alt1 | 2.11.7-alt1.1 | ALT-PU-2024-6834-1 | - | Fixed |
freerdp | sisyphus_loongarch64 | 2.11.6-alt1 | 2.11.7-alt1.1 | ALT-PU-2024-6841-1 | - | Fixed |
freerdp | p10 | 2.11.6-alt1 | 2.11.6-alt1 | ALT-PU-2024-6851-2 | 345435 | Fixed |
freerdp | p10_e2k | 2.11.6-alt1 | 2.11.6-alt1 | ALT-PU-2024-7154-1 | - | Fixed |
freerdp | c10f1 | 2.11.6-alt1 | 2.11.6-alt1 | ALT-PU-2024-6898-2 | 345436 | Fixed |
freerdp | c9f2 | 2.11.6-alt1 | 2.11.6-alt1 | ALT-PU-2024-6847-2 | 345438 | Fixed |
freerdp3 | sisyphus | 3.5.0-alt1 | 3.5.1-alt1 | ALT-PU-2024-6812-1 | 345417 | Fixed |
freerdp3 | sisyphus_riscv64 | 3.5.0-alt1 | 3.5.1-alt1 | ALT-PU-2024-6832-1 | - | Fixed |
freerdp3 | sisyphus_loongarch64 | 3.5.0-alt1 | 3.5.1-alt1 | ALT-PU-2024-6840-1 | - | Fixed |
freerdp3 | p10 | 3.5.0-alt1 | 3.5.0-alt1 | ALT-PU-2024-6812-1 | 345417 | Fixed |