Headline
Ubuntu Security Notice USN-6749-1
Ubuntu Security Notice 6749-1 - It was discovered that FreeRDP incorrectly handled certain context resets. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.
==========================================================================Ubuntu Security Notice USN-6749-1April 24, 2024freerdp2 vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 23.10- Ubuntu 22.04 LTS- Ubuntu 20.04 LTSSummary:Several security issues were fixed in FreeRDP.Software Description:- freerdp2: RDP client for Windows Terminal ServicesDetails:It was discovered that FreeRDP incorrectly handled certain context resets.If a user were tricked into connecting to a malicious server, a remoteattacker could use this issue to cause FreeRDP to crash, resulting in adenial of service, or possibly execute arbitrary code. (CVE-2024-22211)Evgeny Legerov discovered that FreeRDP incorrectly handled certain memoryoperations. If a user were tricked into connecting to a malicious server, aremote attacker could use this issue to cause FreeRDP to crash, resultingin a denial of service, or possibly execute arbitrary code.(CVE-2024-32039, CVE-2024-32040)Evgeny Legerov discovered that FreeRDP incorrectly handled certain memoryoperations. If a user were tricked into connecting to a malicious server, aremote attacker could possibly use this issue to cause FreeRDP to crash,resulting in a denial of service. (CVE-2024-32041, CVE-2024-32458,CVE-2024-32460)Evgeny Legerov discovered that FreeRDP incorrectly handled certain memoryoperations. A remote attacker could possibly use this issue to causeFreeRDP clients and servers to crash, resulting in a denial of service.(CVE-2024-32459)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 23.10: libfreerdp2-2 2.10.0+dfsg1-1.1ubuntu1.2Ubuntu 22.04 LTS: libfreerdp2-2 2.6.1+dfsg1-3ubuntu2.6Ubuntu 20.04 LTS: libfreerdp2-2 2.6.1+dfsg1-0ubuntu0.20.04.1After a standard system update you need to restart your session to make allthe necessary changes.References: https://ubuntu.com/security/notices/USN-6749-1 CVE-2024-22211, CVE-2024-32039, CVE-2024-32040, CVE-2024-32041, CVE-2024-32458, CVE-2024-32459, CVE-2024-32460Package Information: https://launchpad.net/ubuntu/+source/freerdp2/2.10.0+dfsg1-1.1ubuntu1.2 https://launchpad.net/ubuntu/+source/freerdp2/2.6.1+dfsg1-3ubuntu2.6 https://launchpad.net/ubuntu/+source/freerdp2/2.6.1+dfsg1-0ubuntu0.20.04.1Related news
Red Hat Security Advisory 2024-9092-03 - An update for freerdp is now available for Red Hat Enterprise Linux 9. Issues addressed include heap overflow, integer overflow, and out of bounds read vulnerabilities.