Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2020-11040: FreeRDP up to 2.0.0 can display corrupted screen colors
CVE-2020-11040 · published 6 years ago
Summary
Versions of FreeRDP released before 2.1.0 may read data outside its intended area when processing compressed screen information, which can result in visual artifacts such as incorrect colors on the display. This does not affect the security of the connection but can degrade the user experience. Upgrade FreeRDP to version 2.1.0 or later to resolve the issue.
What to do
- Update debian freerdp2 to version 2.1.1+dfsg1-1.
- Update freerdp freerdp to version 2.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | freerdp2 |
< 2.1.1+dfsg1-1 Fix: upgrade to 2.1.1+dfsg1-1
|
| – | freerdp | freerdp |
< 2.1.0 cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.1 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
References
- https://security-tracker.debian.org/tracker/CVE-2020-11040 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4wq-m7c9-rjgr Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html Mailing List Third Party Advisory
Severity
2.7
Low
Type
CWE-125Out-of-bounds Read
Timeline
Published29 May 2020
Updated3 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta