Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.2

FreeRDP 1.1‑1.9 may disconnect when receiving bad data

CVE-2020-11058 · published 6 years ago
Summary

The FreeRDP client used in Debian (versions released after 1.1 but before 2.0.0) can be forced to drop a remote session if a malicious partner sends specially crafted information. This could interrupt work and cause users to lose their connection. Upgrade FreeRDP to version 2.0.0 or later to eliminate the risk.

What to do
  • Update debian freerdp2 to version 2.1.1+dfsg1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian freerdp2 < 2.1.1+dfsg1-1
Fix: upgrade to 2.1.1+dfsg1-1
– freerdp freerdp > 1.1.0, <= 2.0.0
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 16.04
18.04
19.10
20.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
– debian debian_linux 9.0
10.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Original advisory text
In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force ...
In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.
References
Severity
2.2 Low
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-125Out-of-bounds Read
Timeline
Published12 May 2020
Updated3 Nov 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2020-11058 · OSV
CVE-2020-11058 · NVD
Track software like this
Free during beta