ALT-PU-2026-15108: package freerdp3 update to version 3.31.1-alt1
Описание
This update upgrades freerdp3 to version 3.31.1-alt1.
Устраненные уязвимости22
Ссылки23
GHSA-23pf-q83q-x45r
https://github.com/advisories/GHSA-23pf-q83q-x45rGHSA-2vf2-grvj-6g8x
https://github.com/advisories/GHSA-2vf2-grvj-6g8xGHSA-4464-r7qj-pgrx
https://github.com/advisories/GHSA-4464-r7qj-pgrxGHSA-57h7-vw2f-2f9x
https://github.com/advisories/GHSA-57h7-vw2f-2f9xGHSA-6mpx-c8rj-whj5
https://github.com/advisories/GHSA-6mpx-c8rj-whj5GHSA-9jcm-x588-gh26
https://github.com/advisories/GHSA-9jcm-x588-gh26GHSA-c5gr-hmqp-pwj4
https://github.com/advisories/GHSA-c5gr-hmqp-pwj4GHSA-f5p6-88mh-59vg
https://github.com/advisories/GHSA-f5p6-88mh-59vgGHSA-ffjr-p229-hpch
https://github.com/advisories/GHSA-ffjr-p229-hpchGHSA-h5w2-q35j-443h
https://github.com/advisories/GHSA-h5w2-q35j-443hGHSA-hg4r-vv53-vwf8
https://github.com/advisories/GHSA-hg4r-vv53-vwf8GHSA-hw7p-5h2r-83gq
https://github.com/advisories/GHSA-hw7p-5h2r-83gqGHSA-j5mq-3349-gwmm
https://github.com/advisories/GHSA-j5mq-3349-gwmmGHSA-m85m-3qxv-63h5
https://github.com/advisories/GHSA-m85m-3qxv-63h5GHSA-pj8w-fh79-f438
https://github.com/advisories/GHSA-pj8w-fh79-f438GHSA-q65v-4w7q-hx3r
https://github.com/advisories/GHSA-q65v-4w7q-hx3rGHSA-r7jx-j9h7-j4xj
https://github.com/advisories/GHSA-r7jx-j9h7-j4xjGHSA-r9pv-ffph-6gg6
https://github.com/advisories/GHSA-r9pv-ffph-6gg6GHSA-v649-94v2-p72q
https://github.com/advisories/GHSA-v649-94v2-p72qGHSA-vccg-35r5-8jrf
https://github.com/advisories/GHSA-vccg-35r5-8jrfGHSA-w9qg-g24r-77f6
https://github.com/advisories/GHSA-w9qg-g24r-77f6GHSA-x7v6-xfx3-52j6
https://github.com/advisories/GHSA-x7v6-xfx3-52j6Связанные уязвимости
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uniniti ...
