Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
FreeRDP can allow crashes or unauthorized code execution
published 1 year ago
Summary
The FreeRDP client and its related libraries on CentOS may mishandle data, leading to crashes or the possibility of an attacker running code. This happens because the software does not properly check the size of incoming information and can overflow internal counters. Update to the latest FreeRDP packages from your repository to apply the fixes.
What to do
- Update centos freerdp to version 2.1.1-5.el7_9.tuxcare.els4.
- Update centos freerdp-devel to version 2.1.1-5.el7_9.tuxcare.els4.
- Update centos freerdp-libs to version 2.1.1-5.el7_9.tuxcare.els4.
- Update centos libwinpr to version 2.1.1-5.el7_9.tuxcare.els4.
- Update centos libwinpr-devel to version 2.1.1-5.el7_9.tuxcare.els4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | freerdp |
< 2.1.1-5.el7_9.tuxcare.els4 Fix: upgrade to 2.1.1-5.el7_9.tuxcare.els4
|
| TuxCare:CentOS:7 | centos | freerdp-devel |
< 2.1.1-5.el7_9.tuxcare.els4 Fix: upgrade to 2.1.1-5.el7_9.tuxcare.els4
|
| TuxCare:CentOS:7 | centos | freerdp-libs |
< 2.1.1-5.el7_9.tuxcare.els4 Fix: upgrade to 2.1.1-5.el7_9.tuxcare.els4
|
| TuxCare:CentOS:7 | centos | libwinpr |
< 2.1.1-5.el7_9.tuxcare.els4 Fix: upgrade to 2.1.1-5.el7_9.tuxcare.els4
|
| TuxCare:CentOS:7 | centos | libwinpr-devel |
< 2.1.1-5.el7_9.tuxcare.els4 Fix: upgrade to 2.1.1-5.el7_9.tuxcare.els4
|
Original advisory text
freerdp: Fix of 6 CVEs
- CVE-2024-32458: fix missing input length checks
- CVE-2024-32459: fix missing input length check
- CVE-2024-32460: fix out-of-bound read in interleaved_decompress
- CVE-2024-32039: fix integer overflow
- CVE-2024-32040: fix missing check
- CVE-2024-32041: fix integer overflow
- CVE-2024-32459: fix missing input length check
- CVE-2024-32460: fix out-of-bound read in interleaved_decompress
- CVE-2024-32039: fix integer overflow
- CVE-2024-32040: fix missing check
- CVE-2024-32041: fix integer overflow
References
- https://errata.tuxcare.com/centos7-els/CLSA-2025-1739825397.html Vendor Advisory
Timeline
Published17 Feb 2025
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2025-1739825397 · OSV
Track software like this
Free during beta