FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests FreeRDP: FreeRDP: Denial of Service via malformed media data FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption
Affected: Ubuntu:16.04:LTS: freerdp, Ubuntu:Pro:18.04:LTS: freerdp2, Ubuntu:18.04:LTS: freerdp, Ubuntu:Pro:20.04:LTS: freerdp2, Ubuntu:22.04:LTS: freerdp2, Ubuntu:24.04:LTS: freerdp3, Ubuntu:Pro:24.04:LTS: freerdp2, Ubuntu:26.04:LTS: freerdp3
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length.
Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.