CVE-2020-11521

libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.6 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
freerdpfreerdp
1.0.0 <
𝑥
< 2.0.0
freerdpfreerdp
2.0.0
freerdpfreerdp
2.0.0:rc0
freerdpfreerdp
2.0.0:rc1
freerdpfreerdp
2.0.0:rc2
freerdpfreerdp
2.0.0:rc3
freerdpfreerdp
2.0.0:rc4
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
19.10
canonicalubuntu_linux
20.04
opensuseleap
15.1
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
2.10.0+dfsg1-1
fixed
bullseye
2.3.0+dfsg1-2+deb11u1
fixed
sid
2.11.7+dfsg1-4
fixed
trixie
2.11.7+dfsg1-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freerdp
bionic
Fixed 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
released
eoan
dne
focal
dne
groovy
dne
trusty
dne
xenial
Fixed 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
released
freerdp2
bionic
Fixed 2.1.1+dfsg1-0ubuntu0.18.04.1
released
eoan
Fixed 2.1.1+dfsg1-0ubuntu0.19.10.1
released
focal
Fixed 2.1.1+dfsg1-0ubuntu0.20.04.1
released
groovy
not-affected
trusty
dne
xenial
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
freerdp
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
freerdp-devel
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
freerdp-proxy
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
libfreerdp2
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
libwinpr2
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
winpr2-devel
suse enterprise desktop 15 SP1
2.1.2-10.15.1
fixed
suse enterprise desktop 15 SP2
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP3
2.1.2-15.7.1
fixed
suse enterprise desktop 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise sap 15 SP1
2.1.2-10.15.1
fixed
suse enterprise sap 15 SP2
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP3
2.1.2-15.7.1
fixed
suse enterprise sap 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise server 15 SP1
2.1.2-10.15.1
fixed
suse enterprise server 15 SP2
2.1.2-15.7.1
fixed
suse enterprise server 15 SP3
2.1.2-15.7.1
fixed
suse enterprise server 15 SP4
2.4.0-150400.1.12
fixed
suse enterprise workstation 15 SP1
2.1.2-10.15.1
fixed
suse enterprise workstation 15 SP2
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP3
2.1.2-15.7.1
fixed
suse enterprise workstation 15 SP4
2.4.0-150400.1.12
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
freerdp
RHEL 7
0:2.0.0-4.rc4.el7_8
fixed
RHEL 8
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.0 E4S
2:2.0.0-46.rc4.el8_0.1
fixed
RHEL 8.1 E4S
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.1 EUS
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.2 AUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 E4S
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 EUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 TUS
2:2.0.0-46.rc4.el8_2.1
fixed
freerdp-devel
RHEL 7
0:2.0.0-4.rc4.el7_8
fixed
RHEL 8
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.1 E4S
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.1 EUS
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.2 AUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 E4S
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 EUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 TUS
2:2.0.0-46.rc4.el8_2.1
fixed
freerdp-libs
RHEL 7
0:2.0.0-4.rc4.el7_8
fixed
RHEL 8
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.0 E4S
2:2.0.0-46.rc4.el8_0.1
fixed
RHEL 8.1 E4S
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.1 EUS
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.2 AUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 E4S
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 EUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 TUS
2:2.0.0-46.rc4.el8_2.1
fixed
libwinpr
RHEL 7
0:2.0.0-4.rc4.el7_8
fixed
RHEL 8
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.0 E4S
2:2.0.0-46.rc4.el8_0.1
fixed
RHEL 8.1 E4S
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.1 EUS
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.2 AUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 E4S
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 EUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 TUS
2:2.0.0-46.rc4.el8_2.1
fixed
libwinpr-devel
RHEL 7
0:2.0.0-4.rc4.el7_8
fixed
RHEL 8
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.0 E4S
2:2.0.0-46.rc4.el8_0.1
fixed
RHEL 8.1 E4S
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.1 EUS
2:2.0.0-46.rc4.el8_1.1
fixed
RHEL 8.2 AUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 E4S
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 EUS
2:2.0.0-46.rc4.el8_2.1
fixed
RHEL 8.2 TUS
2:2.0.0-46.rc4.el8_2.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
https://github.com/FreeRDP/FreeRDP/commits/master
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w
https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
https://pub.freerdp.com/cve/CVE-2020-11521/pocAnalysis_6.pdf
https://usn.ubuntu.com/4379-1/
https://usn.ubuntu.com/4382-1/
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
https://github.com/FreeRDP/FreeRDP/commits/master
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w
https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
https://pub.freerdp.com/cve/CVE-2020-11521/pocAnalysis_6.pdf
https://usn.ubuntu.com/4379-1/
https://usn.ubuntu.com/4382-1/