Stay Secure with the Latest Linux Advisories

security advisorysecurity issuefedora

Fedora 40 FEDORA-2024-982a7184e0 Critical: FreeRDP2 Out-Of-Bounds

Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041, CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658, CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-982a7184e0 2024-05-09 01:38:47.479723 -------------------------------------------------------------------------------- Name : freerdp2 Product : Fedora 40 Version : 2.11.7 Release : 1.fc40 URL : http://www.freerdp.com/ Summary : Free implementation of the Remote Desktop Protocol (RDP) Description : The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox. -------------------------------------------------------------------------------- Update Information: Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041, CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658, CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662) -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 23 2024 Ondrej Holy - 2:2.11.7-1 - Update to 2.11.7 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2276721 - CVE-2024-32459 freerdp: out-of-bounds read in ncrush_decompress https://bugzilla.redhat.com/show_bug.cgi?id=2276721 [ 2 ] Bug #2276722 - CVE-2024-32460 freerdp: OutOfBound Read in interleaved_decompress https://bugzilla.redhat.com/show_bug.cgi?id=2276722 [ 3 ] Bug #2276723 - CVE-2024-32039 freerdp: Integer overflow & OutOfBound Write in clear_decompress_residual_data https://bugzilla.redhat.com/show_bug.cgi?id=2276723 [ 4 ] Bug #2276724 - CVE-2024-32040 freerdp: integer underflow in nsc_rle_decode https://bugzilla.redhat.com/show_bug.cgi?id=2276724 [ 5 ] Bug #2276725 - CVE-2024-32041 freerdp: OutOfBound Read in zgfx_decompress_segment https://bugzilla.redhat.com/show_bug.cgi?id=2276725 [ 6 ] Bug #2276726 - CVE-2024-32458 freerdp: OutOfBound Read in planar_skip_plane_rle https://bugzilla.redhat.com/show_bug.cgi?id=2276726 [ 7 ] Bug #2276804 - CVE-2024-32662 freerdp: out-of-bounds read https://bugzilla.redhat.com/show_bug.cgi?id=2276804 [ 8 ] Bug #2276961 - CVE-2024-32658 FreeRDP: ExtractRunLengthRegular* out of bound read https://bugzilla.redhat.com/show_bug.cgi?id=2276961 [ 9 ] Bug #2276968 - CVE-2024-32660 freerdp: zgfx_decompress out of memory https://bugzilla.redhat.com/show_bug.cgi?id=2276968 [ 10 ] Bug #2276970 - CVE-2024-32659 freerdp: freerdp_image_copy out of bound read https://bugzilla.redhat.com/show_bug.cgi?id=2276970 [ 11 ] Bug #2276971 - CVE-2024-32661 freerdp: rdp_write_logon_info_v1 NULL access https://bugzilla.redhat.com/show_bug.cgi?id=2276971 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-982a7184e0' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Essential patches for Fedora 40 freerdp2 have been released, targeting various vulnerabilities to fortify RDP security.. Fedora Security Advisory, RDP Client Update, FreeRDP Security Fix. . Severity: Critical. LinuxSecurity.com Team

May 09, 2024 •Critical Fedora