CVE-2020-11040

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.2 LOW
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
Affected Products (NVD)
VendorProductVersion
freerdpfreerdp
𝑥
< 2.1.0
opensuseleap
15.1
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
2.10.0+dfsg1-1
fixed
bullseye
2.3.0+dfsg1-2+deb11u1
fixed
sid
2.11.7+dfsg1-4
fixed
trixie
2.11.7+dfsg1-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freerdp
bionic
not-affected
eoan
dne
focal
dne
trusty
dne
xenial
not-affected
freerdp2
bionic
Fixed 2.1.1+dfsg1-0ubuntu0.18.04.1
released
eoan
Fixed 2.1.1+dfsg1-0ubuntu0.19.10.1
released
focal
Fixed 2.1.1+dfsg1-0ubuntu0.20.04.1
released
trusty
dne
xenial
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
freerdp
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
freerdp-devel
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
freerdp-proxy
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
libfreerdp2
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
libwinpr2
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
winpr2-devel
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
freerdp
RHEL 7
0:2.1.1-2.el7
fixed
RHEL 8
2:2.1.1-1.el8
fixed
freerdp-devel
RHEL 7
0:2.1.1-2.el7
fixed
RHEL 8
2:2.1.1-1.el8
fixed
freerdp-libs
RHEL 7
0:2.1.1-2.el7
fixed
RHEL 8
2:2.1.1-1.el8
fixed
libwinpr
RHEL 7
0:2.1.1-2.el7
fixed
RHEL 8
2:2.1.1-1.el8
fixed
libwinpr-devel
RHEL 7
0:2.1.1-2.el7
fixed
RHEL 8
2:2.1.1-1.el8
fixed
vinagre
RHEL 8
0:3.22.0-23.el8
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4wq-m7c9-rjgr
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4wq-m7c9-rjgr
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html