CVE-2023-39353

Опубликовано: 31 авг. 2023

Источник: nvd

CVSS3: 5.3

CVSS3: 9.1

EPSS Низкий

Описание

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the libfreerdp/codec/rfx.c file there is no offset validation in tile->quantIdxY, tile->quantIdxCb, and tile->quantIdxCr. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

Версия до 2.11.0 (исключая)

cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

EPSS

Процентиль: 24%

0.00078

Низкий

5.3 Medium

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-125

Связанные уязвимости

CVE-2023-39353

CVSS3: 5.3

ubuntu

почти 2 года назад

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2023-39353

CVSS3: 6.5

redhat

почти 2 года назад

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2023-39353

CVSS3: 5.3

debian

почти 2 года назад

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), ...

BDU:2023-05084

CVSS3: 5.3

fstec

около 2 лет назад

Уязвимость компонента libfreerdp/codec/rfx.c RDP-клиента FreeRDP, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании

ELSA-2024-2208

oracle-oval

больше 1 года назад

ELSA-2024-2208: freerdp security update (MODERATE)

EPSS

Процентиль: 24%

0.00078

Низкий

5.3 Medium

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-125