{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39352", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-07-28T13:26:46.478Z", "datePublished": "2023-08-31T20:46:31.858Z", "dateUpdated": "2024-08-02T18:10:20.242Z"}, "containers": {"cna": {"title": "Invalid offset validation leading to Out Of Bound Write in FreeRDP", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"}, {"name": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239", "tags": ["x_refsource_MISC"], "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html"}, {"url": "https://security.gentoo.org/glsa/202401-16"}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "versions": [{"version": "< 2.11.0", "status": "affected"}, {"version": ">= 3.0.0-beta1, < 3.0.0-beta3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-31T20:46:31.858Z"}, "descriptions": [{"lang": "en", "value": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n"}], "source": {"advisory": "GHSA-whwr-qcf2-2mvj", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:20.242Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"}, {"name": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202401-16", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "matchCriteriaId": "80B02150-FC4E-43F5-A3DF-D8E585200977", "versionEndExcluding": "2.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "D8720D61-0B0D-40ED-B3C4-B452D83BF3C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "18A75D02-0E7A-4AAF-8E23-0CDCB1733FEA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n"}, {"lang": "es", "value": "FreeRDP es una implementaci\u00f3n gratuita del Protocolo de escritorio remoto (RDP), publicada bajo la licencia Apache. Las versiones afectadas est\u00e1n sujetas a una validaci\u00f3n de compensaci\u00f3n no v\u00e1lida que conduce a una escritura fuera de l\u00edmites. Esto se puede activar cuando los valores `rect-&gt;left` y `rect-&gt;top` son exactamente iguales a `surface-&gt;width` y `surface-&gt;height`. p.ej. `rect-&gt;izquierda` == `superficie-&gt;ancho` &amp;&amp; `rect-&gt;top` == `superficie-&gt;alto`. En la pr\u00e1ctica, esto deber\u00eda provocar un bloqueo. Este problema se solucion\u00f3 en las versiones 2.11.0 y 3.0.0-beta3. Se recomienda a los usuarios que actualicen. No se conocen soluciones para esta vulnerabilidad."}], "id": "CVE-2023-39352", "lastModified": "2024-11-21T08:15:13.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-08-31T21:15:07.873", "references": [{"source": "[email protected]", "tags": ["Issue Tracking"], "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239"}, {"source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"}, {"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/"}, {"source": "[email protected]", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/"}, {"source": "[email protected]", "url": "https://security.gentoo.org/glsa/202401-16"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202401-16"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:2208", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "freerdp-2:2.11.2-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "freerdp: invalid offset validation leading to Out Of Bound Write", "id": "2236766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2236766"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-787", "details": ["FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "A flaw was found in FreeRDP. An out-of-bounds write may occur when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. This issue can result in a crash."], "name": "CVE-2023-39352", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2023-08-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-39352\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-39352\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj"], "threat_severity": "Moderate", "upstream_fix": "freerdp 2.11.0, freerdp 3.0.0-beta3"}