The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6401-1 advisory.

    It was discovered that FreeRDP did not properly manage certain inputs. A malicious server could use this     issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive

    information. (CVE-2023-39350, CVE-2023-39351,

    CVE-2023-39353,

    CVE-2023-39354, CVE-2023-40181, CVE-2023-40188, CVE-2023-40589)

    It was discovered that FreeRDP did not properly manage certain inputs. A malicious server could use this     issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2023-40186, CVE-2023-40567, CVE-2023-40569)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2208 advisory.

    [2:2.11.2-1]
    - Update to 2.11.2 (RHEL-4290, RHEL-4292, RHEL-4296, RHEL-4298, RHEL-4300,       RHEL-4302, RHEL-4304, RHEL-4306, RHEL-4308, RHEL-4310, RHEL-4312,       RHEL-10060)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of freerdp installed on the remote host is prior to 2.11.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2269 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with     default compilation flags). When an insufficient blockLen is provided, and proper length validation is not     performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-39350)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling.  Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the     `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and     `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will     cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39353)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-     Of-Bounds Read occurs because it processes `context->Planes` without  checking if it contains data of     sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a     crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-39354)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a missing offset validation may lead to an Out Of Bound Read in the function     `gdi_multi_opaque_rect`. In particular there is no code to validate if the value     `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles     without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash.
    This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are     no known workarounds for this vulnerability. (CVE-2023-39356)

    NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8 (CVE-2023-40181)

    NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v (CVE-2023-40186)

    NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq (CVE-2023-40188)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in     which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This     issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no     known workarounds for this vulnerability. (CVE-2023-40567)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This     issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been     addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds     for this vulnerability. (CVE-2023-40569)

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted     input into this function can trigger the overflow which has only been shown to cause a crash. This issue     has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-40589)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2208 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)

    * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)

    * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)

    * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect     (CVE-2023-39356)

    * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface     (CVE-2023-40186)

    * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)

    * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations     (CVE-2023-40569)

    * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)

    * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)

    * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)

    * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)

    * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
182520	Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : FreeRDP vulnerabilities (USN-6401-1)	Nessus	Ubuntu Local Security Checks	2023/10/4	2024/8/27	critical
195051	Oracle Linux 9 : freerdp (ELSA-2024-2208)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	critical
182646	Amazon Linux 2 : freerdp (ALAS-2023-2269)	Nessus	Amazon Linux Local Security Checks	2023/10/5	2024/12/11	critical
194814	RHEL 9 : freerdp (RHSA-2024:2208)	Nessus	Red Hat Local Security Checks	2024/4/30	2025/3/14	critical
182754	Debian dla-3606 : freerdp2-dev - security update	Nessus	Debian Local Security Checks	2023/10/8	2025/1/22	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical