Поиск уязвимостей
Количество 23
Количество 23
GHSA-98x3-97xw-cfqr
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.
GHSA-q3cv-4fpg-3hq2
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
ALT-PU-2026-17187
ALT-PU-2026-17187: package `freerdp3` update to version 3.32.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-98x3-97xw-cfqr FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation. | CVSS3: 7.4 | 0% Низкий | 23 дня назад |
| GHSA-q3cv-4fpg-3hq2 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client. | CVSS3: 7.1 | 0% Низкий | 25 дней назад |
| ALT-PU-2026-17187 ALT-PU-2026-17187: package `freerdp3` update to version 3.32.1-alt1 | CVSS3: 9.1 | около 1 месяца назад |
Уязвимостей на страницу