Red Hat Security Advisory: freerdp security update

Moderate

A flaw was found in FreeRDP. When an insufficient blockLen value is provided and proper length validation is not performed, an Integer Underflow can occur, leading to a Denial of Service (DOS).

CWE-191 - Integer Underflow (Wrap or Wraparound)

A flaw was found in FreeRDP. If the initialization process of tiles is incomplete, for various reasons, tiles will have a NULL pointer. This can be accessed in further processing, causing a program crash.

CWE-476 - NULL Pointer Dereference

A flaw was found in FreeRDP. An out-of-bounds write may occur when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. This issue can result in a crash.

CWE-787 - Out-of-bounds Write

A flaw was found in FreeRDP. In the `libfreerdp/codec/rfx.c` file, there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result, crafted input can lead to an out-of-bounds read, which may result in a crash.

CWE-125 - Out-of-bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE-125 - Out-of-bounds Read

A flaw was found in FreeRDP. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to a heap-buffer-overflow, which may result in a crash.

CWE-125 - Out-of-bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

CWE-191 - Integer Underflow (Wrap or Wraparound)

An integer overflow vulnerability was found in the `gdi_CreateSurface` function in FreeRDP, which may result in a crash.

CWE-787 - Out-of-bounds Write

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

CWE-125 - Out-of-bounds Read