CVE-2020-11039 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 37%

Affected Products (NVD)

Vendor	Product	Version
freerdp	freerdp	𝑥 < 2.1.0
opensuse	leap	15.1
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freerdp2

bookworm	2.10.0+dfsg1-1 fixed
bullseye	2.3.0+dfsg1-2+deb11u1 fixed
sid	2.11.7+dfsg1-4 fixed
trixie	2.11.7+dfsg1-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

freerdp

bionic	needed
eoan	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
mantic	dne
noble	dne
trusty	dne
xenial	needed

freerdp2

bionic	Fixed 2.1.1+dfsg1-0ubuntu0.18.04.1 released
eoan	Fixed 2.1.1+dfsg1-0ubuntu0.19.10.1 released
focal	Fixed 2.1.1+dfsg1-0ubuntu0.20.04.1 released
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	dne
xenial	dne

openSUSE / SLES Releases

openSUSE Product

Release

freerdp

suse enterprise desktop 15 SP1	2.1.2-10.15.1 fixed
suse enterprise desktop 15 SP2	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP1	2.1.2-10.15.1 fixed
suse enterprise sap 15 SP2	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP1	2.1.2-10.15.1 fixed
suse enterprise server 15 SP2	2.1.2-15.7.1 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP1	2.1.2-10.15.1 fixed
suse enterprise workstation 15 SP2	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

freerdp-devel

suse enterprise desktop 15 SP1	2.1.2-10.15.1 fixed
suse enterprise desktop 15 SP2	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP1	2.1.2-10.15.1 fixed
suse enterprise sap 15 SP2	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP1	2.1.2-10.15.1 fixed
suse enterprise server 15 SP2	2.1.2-15.7.1 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP1	2.1.2-10.15.1 fixed
suse enterprise workstation 15 SP2	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

freerdp-proxy

suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

libfreerdp2

suse enterprise desktop 15 SP1	2.1.2-10.15.1 fixed
suse enterprise desktop 15 SP2	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP1	2.1.2-10.15.1 fixed
suse enterprise sap 15 SP2	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP1	2.1.2-10.15.1 fixed
suse enterprise server 15 SP2	2.1.2-15.7.1 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP1	2.1.2-10.15.1 fixed
suse enterprise workstation 15 SP2	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

libwinpr2

suse enterprise desktop 15 SP1	2.1.2-10.15.1 fixed
suse enterprise desktop 15 SP2	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP1	2.1.2-10.15.1 fixed
suse enterprise sap 15 SP2	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP1	2.1.2-10.15.1 fixed
suse enterprise server 15 SP2	2.1.2-15.7.1 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP1	2.1.2-10.15.1 fixed
suse enterprise workstation 15 SP2	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

winpr2-devel

suse enterprise desktop 15 SP1	2.1.2-10.15.1 fixed
suse enterprise desktop 15 SP2	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP3	2.1.2-15.7.1 fixed
suse enterprise desktop 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise sap 15 SP1	2.1.2-10.15.1 fixed
suse enterprise sap 15 SP2	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP3	2.1.2-15.7.1 fixed
suse enterprise sap 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise server 15 SP1	2.1.2-10.15.1 fixed
suse enterprise server 15 SP2	2.1.2-15.7.1 fixed
suse enterprise server 15 SP3	2.1.2-15.7.1 fixed
suse enterprise server 15 SP4	2.4.0-150400.1.12 fixed
suse enterprise workstation 15 SP1	2.1.2-10.15.1 fixed
suse enterprise workstation 15 SP2	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP3	2.1.2-15.7.1 fixed
suse enterprise workstation 15 SP4	2.4.0-150400.1.12 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

freerdp

RHEL 7	0:2.1.1-2.el7 fixed
RHEL 8	2:2.1.1-1.el8 fixed

freerdp-devel

RHEL 7	0:2.1.1-2.el7 fixed
RHEL 8	2:2.1.1-1.el8 fixed

freerdp-libs

RHEL 7	0:2.1.1-2.el7 fixed
RHEL 8	2:2.1.1-1.el8 fixed

libwinpr

RHEL 7	0:2.1.1-2.el7 fixed
RHEL 8	2:2.1.1-1.el8 fixed

libwinpr-devel

RHEL 7	0:2.1.1-2.el7 fixed
RHEL 8	2:2.1.1-1.el8 fixed

vinagre

RHEL 8

0:3.22.0-23.el8

fixed

Common Weakness Enumeration

CWE-190 - Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mx9p-f6q8-mqwq

https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mx9p-f6q8-mqwq

https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html