CVE catalog

CVE-2023-39356

freerdp2: CVE-2023-39356

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.81% · Oct 25, 2026

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfreerdp2bookworm2.11.7+dfsg1-6~deb12u1fixed
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-1vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-5vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-6vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-6build1vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-7vulnerable
Ubuntufreerdp2pro2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1vulnerable
Ubuntufreerdp2pro2.1.1+dfsg1-0ubuntu0.18.04.1vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.1vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.2vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.3vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.4vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.4+esm1vulnerable
Ubuntufreerdp2pro2.2.0+dfsg1-0ubuntu0.18.04.4+esm2fixed
Ubuntufreerdp220.042.0.0~git20190204.1.2693389a+dfsg1-1vulnerable
Ubuntufreerdp220.042.0.0~git20190204.1.2693389a+dfsg1-2vulnerable
Ubuntufreerdp220.042.0.0~git20190204.1.2693389a+dfsg1-2build1vulnerable
Ubuntufreerdp220.042.0.0~git20190204.1.2693389a+dfsg1-2build2vulnerable
Ubuntufreerdp220.042.1.1+dfsg1-0ubuntu0.20.04.1vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.1vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.2vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.3vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.4vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.5vulnerable
Ubuntufreerdp220.042.2.0+dfsg1-0ubuntu0.20.04.6fixed
Ubuntufreerdp222.042.3.0+dfsg1-2build1vulnerable
Ubuntufreerdp222.042.3.0+dfsg1-2ubuntu1vulnerable
Ubuntufreerdp222.042.3.0+dfsg1-2ubuntu2vulnerable
Ubuntufreerdp222.042.4.1+dfsg1-1vulnerable
Ubuntufreerdp222.042.4.1+dfsg1-1ubuntu1vulnerable
Ubuntufreerdp222.042.4.1+dfsg1-1ubuntu2vulnerable
Ubuntufreerdp222.042.5.0+dfsg1-1vulnerable
Ubuntufreerdp222.042.6.0+dfsg1-1vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-1vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu1vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2.1vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2.2vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2.3vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2.4vulnerable
Ubuntufreerdp222.042.6.1+dfsg1-3ubuntu2.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfreerdp2sourcebookworm2.11.7+dfsg1-6~deb12u1not yet assignedNot reported[1051638]
Ubuntufreerdp2debpro2.2.0+dfsg1-0ubuntu0.18.04.4+esm2Not reportedUBUNTU-CVE-2023-39356Not reported
Ubuntufreerdp2deb20.042.2.0+dfsg1-0ubuntu0.20.04.6Not reportedUBUNTU-CVE-2023-39356Not reported
Ubuntufreerdp2deb22.042.6.1+dfsg1-3ubuntu2.5Not reportedUBUNTU-CVE-2023-39356Not reported

[Debian bug #1051638]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]