Описание
Security update for freerdp
This update for freerdp fixes the following issues:
- CVE-2026-24491: heap-use-after-free in video_timer (bsc#1257981).
- CVE-2026-24675: heap-use-after-free in urb_select_interface (bsc#1257982).
- CVE-2026-24676: heap-use-after-free in audio_format_compatible (bsc#1257983).
- CVE-2026-24679: heap-buffer-overflow in urb_select_interface (bsc#1257986).
- CVE-2026-24681: heap-use-after-free in urb_bulk_transfer_cb (bsc#1257988).
- CVE-2026-24682: heap-buffer-overflow in audio_formats_free (bsc#1257989).
- CVE-2026-24683: heap-use-after-free in ainput_send_input_event (bsc#1257990).
- CVE-2026-24684: heap-use-after-free in play_thread (bsc#1257991).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2026:0649-1
- E-Mail link for SUSE-SU-2026:0649-1
- SUSE Security Ratings
- SUSE Bug 1257981
- SUSE Bug 1257982
- SUSE Bug 1257983
- SUSE Bug 1257986
- SUSE Bug 1257988
- SUSE Bug 1257989
- SUSE Bug 1257990
- SUSE Bug 1257991
- SUSE CVE CVE-2026-24491 page
- SUSE CVE CVE-2026-24675 page
- SUSE CVE CVE-2026-24676 page
- SUSE CVE CVE-2026-24679 page
- SUSE CVE CVE-2026-24681 page
- SUSE CVE CVE-2026-24682 page
- SUSE CVE CVE-2026-24683 page
- SUSE CVE CVE-2026-24684 page
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24491
- SUSE Bug 1257981
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24675
- SUSE Bug 1257982
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24676
- SUSE Bug 1257983
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24679
- SUSE Bug 1257986
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24681
- SUSE Bug 1257988
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24682
- SUSE Bug 1257989
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24683
- SUSE Bug 1257990
Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.
Затронутые продукты
Ссылки
- CVE-2026-24684
- SUSE Bug 1257991