Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-11045: Out-of-bounds Read (CWE-125)
value: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 3.3
Published: 2020-05-07T19:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/update.c
Commit date: 2020-04-02 17:28:10 +0200
Commit message: Fixed #6005: Bounds checks in update_read_bitmap_data

Diff: diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 0864696825..0bae7f3799 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -101,10 +101,13 @@ static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA*
 
 	if (bitmapData->flags & BITMAP_COMPRESSION)
 	{
 		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR))
 		{
+			if (Stream_GetRemainingLength(s) < 8)
+				return FALSE;
+
 			Stream_Read_UINT16(s,
 			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */
 			Stream_Read_UINT16(s,
 			                   bitmapData->cbCompMainBodySize); /* cbCompMainBodySize (2 bytes) */
 			Stream_Read_UINT16(s, bitmapData->cbScanWidth);     /* cbScanWidth (2 bytes) */

Fixed code: 			if (Stream_GetRemainingLength(s) < 8)
				return FALSE;
CVE-2020-11046: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 2.2
Published: 2020-05-07T19:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/update.c
Commit date: 2020-04-02 17:28:04 +0200
Commit message: Fixed #6006: bounds checks in update_read_synchronize

Diff: diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 8c0658d126..0864696825 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -285,18 +285,18 @@ PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s)
 fail:
 	free_palette_update(update->context, palette_update);
 	return NULL;
 }
 
-static void update_read_synchronize(rdpUpdate* update, wStream* s)
+static BOOL update_read_synchronize(rdpUpdate* update, wStream* s)
 {
 	WINPR_UNUSED(update);
-	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
-	                       /**
-	                        * The Synchronize Update is an artifact from the
-	                        * T.128 protocol and should be ignored.
-	                        */
+	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */
+	                              /**
+	                               * The Synchronize Update is an artifact from the
+	                               * T.128 protocol and should be ignored.
+	                               */
 }
 
 static BOOL update_read_play_sound(wStream* s, PLAY_SOUND_UPDATE* play_sound)
 {
 	if (Stream_GetRemainingLength(s) < 8)
@@ -805,11 +805,12 @@ BOOL update_recv(rdpUpdate* update, wStream* s)
 			free_palette_update(context, palette_update);
 		}
 		break;
 
 		case UPDATE_TYPE_SYNCHRONIZE:
-			update_read_synchronize(update, s);
+			if (!update_read_synchronize(update, s))
+				goto fail;
 			rc = IFCALLRESULT(TRUE, update->Synchronize, context);
 			break;
 
 		default:
 			break;

Vulnerable code: static void update_read_synchronize(rdpUpdate* update, wStream* s)
	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
	                       /**
	                        * The Synchronize Update is an artifact from the
	                        * T.128 protocol and should be ignored.
	                        */
			update_read_synchronize(update, s);
Fixed code: static BOOL update_read_synchronize(rdpUpdate* update, wStream* s)
	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */
	                              /**
	                               * The Synchronize Update is an artifact from the
	                               * T.128 protocol and should be ignored.
	                               */
			if (!update_read_synchronize(update, s))
				goto fail;
CVE-2020-11047: Out-of-bounds Read (CWE-125)
value: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.9
Published: 2020-05-07T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/autodetect.c
Commit date: 2020-04-02 17:27:59 +0200
Commit message: Fixed #6009: Bounds checks in autodetect_recv_bandwidth_measure_results

Diff: diff --git a/libfreerdp/core/autodetect.c b/libfreerdp/core/autodetect.c
index 215a366084..c846fb5a92 100644
--- a/libfreerdp/core/autodetect.c
+++ b/libfreerdp/core/autodetect.c
@@ -463,10 +463,12 @@ static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s,
 
 	if (autodetectRspPdu->headerLength != 0x0E)
 		return FALSE;
 
 	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU");
+	if (Stream_GetRemainingLength(s) < 8)
+		return -1;
 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */
 	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */
 
 	if (rdp->autodetect->bandwidthMeasureTimeDelta > 0)
 		rdp->autodetect->netCharBandwidth = rdp->autodetect->bandwidthMeasureByteCount * 8 /

Fixed code: 	if (Stream_GetRemainingLength(s) < 8)
		return -1;
CVE-2020-11049: Out-of-bounds Read (CWE-125)
value: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 2.2
Published: 2020-05-07T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: Unknown
Commit date: 2020-04-06 13:53:28 +0200
Commit message: Merge pull request #6019 from akallabeth/bound_access_fixes

Fix issues with boundary access.
CVE-2020-11058: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 2.2
Published: 2020-05-12T21:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/capabilities.c
Commit date: 2020-04-02 17:28:17 +0200
Commit message: Fixed #6011: Bounds check in rdp_read_font_capability_set

Diff: diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index be0c2d5a6b..93ba8e19d3 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -1395,14 +1395,14 @@ static BOOL rdp_print_input_capability_set(wStream* s, UINT16 length)
  */
 
 static BOOL rdp_read_font_capability_set(wStream* s, UINT16 length, rdpSettings* settings)
 {
 	WINPR_UNUSED(settings);
-	if (length > 4)
+	if (length > 5)
 		Stream_Seek_UINT16(s); /* fontSupportFlags (2 bytes) */
 
-	if (length > 6)
+	if (length > 7)
 		Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
 
 	return TRUE;
 }
 

Vulnerable code: 	if (length > 4)
	if (length > 6)
Fixed code: 	if (length > 5)
	if (length > 7)
CVE-2020-11088: Out-of-bounds Read (CWE-125)
value: In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.4
Published: 2020-05-29T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: winpr/libwinpr/sspi/NTLM/ntlm_message.c
Commit date: 2020-05-06 13:31:57 +0200
Commit message: Fixed oob read in ntlm_read_NegotiateMessage

Diff: diff --git a/winpr/libwinpr/sspi/NTLM/ntlm_message.c b/winpr/libwinpr/sspi/NTLM/ntlm_message.c
index e5586c9f58..c4ba1d9749 100644
--- a/winpr/libwinpr/sspi/NTLM/ntlm_message.c
+++ b/winpr/libwinpr/sspi/NTLM/ntlm_message.c
@@ -217,10 +217,15 @@ SECURITY_STATUS ntlm_read_NegotiateMessage(NTLM_CONTEXT* context, PSecBuffer buf
 	{
 		Stream_Free(s, FALSE);
 		return SEC_E_INVALID_TOKEN;
 	}
 
+	if (Stream_GetRemainingLength(s) < 4)
+	{
+		Stream_Free(s, FALSE);
+		return SEC_E_INVALID_TOKEN;
+	}
 	Stream_Read_UINT32(s, message->NegotiateFlags); /* NegotiateFlags (4 bytes) */
 
 	if (!((message->NegotiateFlags & NTLMSSP_REQUEST_TARGET) &&
 	      (message->NegotiateFlags & NTLMSSP_NEGOTIATE_NTLM) &&
 	      (message->NegotiateFlags & NTLMSSP_NEGOTIATE_UNICODE)))

Fixed code: 	if (Stream_GetRemainingLength(s) < 4)
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
CVE-2020-11089: Out-of-bounds Read (CWE-125)
value: In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-05-29T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: channels/parallel/client/parallel_main.c
Commit date: 2020-05-06 13:31:57 +0200
Commit message: Fixed oob read in parallel_process_irp_create

Diff: diff --git a/channels/parallel/client/parallel_main.c b/channels/parallel/client/parallel_main.c
index 734cf9667a..af3e82703a 100644
--- a/channels/parallel/client/parallel_main.c
+++ b/channels/parallel/client/parallel_main.c
@@ -81,17 +81,23 @@ typedef struct _PARALLEL_DEVICE PARALLEL_DEVICE;
  */
 static UINT parallel_process_irp_create(PARALLEL_DEVICE* parallel, IRP* irp)
 {
 	char* path = NULL;
 	int status;
+	WCHAR* ptr;
 	UINT32 PathLength;
-	Stream_Seek(irp->input, 28);
+	if (!Stream_SafeSeek(irp->input, 28))
+		return ERROR_INVALID_DATA;
 	/* DesiredAccess(4) AllocationSize(8), FileAttributes(4) */
 	/* SharedAccess(4) CreateDisposition(4), CreateOptions(4) */
+	if (Stream_GetRemainingLength(irp->input) < 4)
+		return ERROR_INVALID_DATA;
 	Stream_Read_UINT32(irp->input, PathLength);
-	status = ConvertFromUnicode(CP_UTF8, 0, (WCHAR*)Stream_Pointer(irp->input), PathLength / 2,
-	                            &path, 0, NULL, NULL);
+	ptr = (WCHAR*)Stream_Pointer(irp->input);
+	if (!Stream_SafeSeek(irp->input, PathLength))
+		return ERROR_INVALID_DATA;
+	status = ConvertFromUnicode(CP_UTF8, 0, ptr, PathLength / 2, &path, 0, NULL, NULL);
 
 	if (status < 1)
 		if (!(path = (char*)calloc(1, 1)))
 		{
 			WLog_ERR(TAG, "calloc failed!");

Vulnerable code: 	Stream_Seek(irp->input, 28);
	status = ConvertFromUnicode(CP_UTF8, 0, (WCHAR*)Stream_Pointer(irp->input), PathLength / 2,
	                            &path, 0, NULL, NULL);
Fixed code: 	WCHAR* ptr;
	if (!Stream_SafeSeek(irp->input, 28))
		return ERROR_INVALID_DATA;
	if (Stream_GetRemainingLength(irp->input) < 4)
		return ERROR_INVALID_DATA;
	ptr = (WCHAR*)Stream_Pointer(irp->input);
	if (!Stream_SafeSeek(irp->input, PathLength))
		return ERROR_INVALID_DATA;
	status = ConvertFromUnicode(CP_UTF8, 0, ptr, PathLength / 2, &path, 0, NULL, NULL);
CVE-2020-11098: Out-of-bounds Read (CWE-125)
value: In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-06-22T22:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/cache/glyph.c
Commit date: 2020-06-22 11:51:38 +0200
Commit message: Fixed Out-of-bound read in glyph_cache_put

CVE-2020-11098 thanks to @antonio-morales for finding this.

Diff: diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c
index 9f5e4a3013a..5c41f912a10 100644
--- a/libfreerdp/cache/glyph.c
+++ b/libfreerdp/cache/glyph.c
@@ -577,11 +577,11 @@ BOOL glyph_cache_put(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index, rdpGlyp
 	{
 		WLog_ERR(TAG, "invalid glyph cache id: %" PRIu32 "", id);
 		return FALSE;
 	}
 
-	if (index > glyphCache->glyphCache[id].number)
+	if (index >= glyphCache->glyphCache[id].number)
 	{
 		WLog_ERR(TAG, "invalid glyph cache index: %" PRIu32 " in cache id: %" PRIu32 "", index, id);
 		return FALSE;
 	}
 

Vulnerable code: 	if (index > glyphCache->glyphCache[id].number)
Fixed code: 	if (index >= glyphCache->glyphCache[id].number)
CVE-2020-11099: Out-of-bounds Read (CWE-125)
value: In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-06-22T22:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/license.c
Commit date: 2020-06-22 11:51:38 +0200
Commit message: Fixed OOB Read in license_read_new_or_upgrade_license_packet

CVE-2020-11099 thanks to @antonio-morales for finding this.

Diff: diff --git a/libfreerdp/core/license.c b/libfreerdp/core/license.c
index 18bcb9fa47e..097107b7038 100644
--- a/libfreerdp/core/license.c
+++ b/libfreerdp/core/license.c
@@ -1250,10 +1250,13 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 
 	licenseStream = Stream_New(calBlob->data, calBlob->length);
 	if (!licenseStream)
 		goto out_free_blob;
 
+	if (Stream_GetRemainingLength(licenseStream) < 8)
+		goto out_free_stream;
+
 	Stream_Read_UINT16(licenseStream, os_minor);
 	Stream_Read_UINT16(licenseStream, os_major);
 
 	/* Scope */
 	Stream_Read_UINT32(licenseStream, cbScope);
@@ -1264,30 +1267,36 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 	winpr_HexDump(TAG, WLOG_DEBUG, Stream_Pointer(licenseStream), cbScope);
 #endif
 	Stream_Seek(licenseStream, cbScope);
 
 	/* CompanyName */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbCompanyName);
 	if (Stream_GetRemainingLength(licenseStream) < cbCompanyName)
 		goto out_free_stream;
 #ifdef WITH_DEBUG_LICENSE
 	WLog_DBG(TAG, "Company name:");
 	winpr_HexDump(TAG, WLOG_DEBUG, Stream_Pointer(licenseStream), cbCompanyName);
 #endif
 	Stream_Seek(licenseStream, cbCompanyName);
 
 	/* productId */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbProductId);
 	if (Stream_GetRemainingLength(licenseStream) < cbProductId)
 		goto out_free_stream;
 #ifdef WITH_DEBUG_LICENSE
 	WLog_DBG(TAG, "Product id:");
 	winpr_HexDump(TAG, WLOG_DEBUG, Stream_Pointer(licenseStream), cbProductId);
 #endif
 	Stream_Seek(licenseStream, cbProductId);
 
 	/* licenseInfo */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbLicenseInfo);
 	if (Stream_GetRemainingLength(licenseStream) < cbLicenseInfo)
 		goto out_free_stream;
 
 	license->state = LICENSE_STATE_COMPLETED;

Fixed code: 	if (Stream_GetRemainingLength(licenseStream) < 8)
		goto out_free_stream;

	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
CVE-2020-13396: Out-of-bounds Read (CWE-125)
value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2020-05-22T18:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: Other
Files changed: ChangeLog
Commit date: 2020-05-20 16:33:29 +0200
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)

Diff: diff --git a/ChangeLog b/ChangeLog
index a61d04822cd..593cb89a6d0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,23 @@
+# 2020-05-20  Version 2.1.1
+
+Important notes:
+* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
+* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
+* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
+* Enforce synchronous legacy RDP encryption count (#6156)
+* Fixed some leaks and crashes missed in 2.1.0
+* Removed dynamic channel listener limits
+* Lots of resource cleanup fixes (clang sanitizers)
+* A couple of performance improvements
+* Various small annoyances eliminated (typos, prefilled username for windows client, ...)
+
+
+For a complete and detailed change log since the last release candidate run:
+git log 2.1.0..2.1.1
+
+
 # 2020-05-05  Version 2.1.0
 
 Important notes:
 
 * fix multiple CVEs: CVE-2020-11039, CVE-2020-11038, CVE-2020-11043, CVE-2020-11040, CVE-2020-11041,

Fixed code: # 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-13397: Out-of-bounds Read (CWE-125)
value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2020-05-22T18:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: Other
Files changed: ChangeLog
Commit date: 2020-05-20 16:33:29 +0200
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)

Diff: diff --git a/ChangeLog b/ChangeLog
index a61d04822cd..593cb89a6d0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,23 @@
+# 2020-05-20  Version 2.1.1
+
+Important notes:
+* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
+* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
+* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
+* Enforce synchronous legacy RDP encryption count (#6156)
+* Fixed some leaks and crashes missed in 2.1.0
+* Removed dynamic channel listener limits
+* Lots of resource cleanup fixes (clang sanitizers)
+* A couple of performance improvements
+* Various small annoyances eliminated (typos, prefilled username for windows client, ...)
+
+
+For a complete and detailed change log since the last release candidate run:
+git log 2.1.0..2.1.1
+
+
 # 2020-05-05  Version 2.1.0
 
 Important notes:
 
 * fix multiple CVEs: CVE-2020-11039, CVE-2020-11038, CVE-2020-11043, CVE-2020-11040, CVE-2020-11041,

Fixed code: # 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-13398: Out-of-bounds Write (CWE-787)
value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.3
Published: 2020-05-22T18:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: Other
Files changed: ChangeLog
Commit date: 2020-05-20 16:33:29 +0200
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)

Diff: diff --git a/ChangeLog b/ChangeLog
index a61d04822cd..593cb89a6d0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,23 @@
+# 2020-05-20  Version 2.1.1
+
+Important notes:
+* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
+* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
+* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
+* Enforce synchronous legacy RDP encryption count (#6156)
+* Fixed some leaks and crashes missed in 2.1.0
+* Removed dynamic channel listener limits
+* Lots of resource cleanup fixes (clang sanitizers)
+* A couple of performance improvements
+* Various small annoyances eliminated (typos, prefilled username for windows client, ...)
+
+
+For a complete and detailed change log since the last release candidate run:
+git log 2.1.0..2.1.1
+
+
 # 2020-05-05  Version 2.1.0
 
 Important notes:
 
 * fix multiple CVEs: CVE-2020-11039, CVE-2020-11038, CVE-2020-11043, CVE-2020-11040, CVE-2020-11041,

Fixed code: # 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-4030: Out-of-bounds Read (CWE-125)
value: In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-06-22T22:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: winpr/libwinpr/utils/trio/trio.c, winpr/libwinpr/utils/trio/triostr.c
Commit date: 2020-06-22 11:51:38 +0200
Commit message: Fixed TrioParse and trio_length limts.

CVE-2020-4030 thanks to @antonio-morales for finding this.

Diff: diff --git a/winpr/libwinpr/utils/trio/trio.c b/winpr/libwinpr/utils/trio/trio.c
index ec765ce5af4..b278f475b75 100644
--- a/winpr/libwinpr/utils/trio/trio.c
+++ b/winpr/libwinpr/utils/trio/trio.c
@@ -2727,11 +2727,11 @@ TRIO_PRIVATE void TrioWriteStringCharacter TRIO_ARGS3((self, ch, flags), trio_cl
  */
 TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precision),
                                              trio_class_t* self, TRIO_CONST char* string,
                                              trio_flags_t flags, int width, int precision)
 {
-	int length;
+	int length = 0;
 	int ch;
 
 	assert(VALID(self));
 	assert(VALID(self->OutStream));
 
@@ -2745,11 +2745,11 @@ TRIO_PRIVATE void TrioWriteString TRIO_ARGS5((self, string, flags, width, precis
 #endif
 		width = 0;
 	}
 	else
 	{
-		if (precision == 0)
+		if (precision <= 0)
 		{
 			length = trio_length(string);
 		}
 		else
 		{
@@ -4752,11 +4752,11 @@ TRIO_PUBLIC trio_pointer_t trio_register TRIO_ARGS2((callback, name), trio_callb
 			}
 			return NULL;
 		}
 
 		/* Bail out if namespace is too long */
-		if (trio_length(name) >= MAX_USER_NAME)
+		if (trio_length_max(name, MAX_USER_NAME) >= MAX_USER_NAME)
 			return NULL;
 
 		/* Bail out if namespace already is registered */
 		def = TrioFindNamespace(name, &prev);
 		if (def)
diff --git a/winpr/libwinpr/utils/trio/triostr.c b/winpr/libwinpr/utils/trio/triostr.c
index da12775acf7..6832ad5aef6 100644
--- a/winpr/libwinpr/utils/trio/triostr.c
+++ b/winpr/libwinpr/utils/trio/triostr.c
@@ -23,10 +23,11 @@
 #include <config.h>
 #endif
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include <ctype.h>
 #include "triodef.h"
 #include "triostr.h"
 #if defined(TRIO_FUNC_TO_LONG_DOUBLE)
 #define USE_MATH
@@ -326,11 +327,11 @@ TRIO_PUBLIC_STRING void trio_destroy TRIO_ARGS1((string), char* string)
 */
 #if defined(TRIO_FUNC_LENGTH)
 
 TRIO_PUBLIC_STRING size_t trio_length TRIO_ARGS1((string), TRIO_CONST char* string)
 {
-	return strlen(string);
+	return trio_length_max(string, INT_MAX);
 }
 
 #endif
 
 /**

Vulnerable code: 	int length;
		if (precision == 0)
		if (trio_length(name) >= MAX_USER_NAME)
	return strlen(string);
Fixed code: 	int length = 0;
		if (precision <= 0)
		if (trio_length_max(name, MAX_USER_NAME) >= MAX_USER_NAME)
#include <limits.h>
	return trio_length_max(string, INT_MAX);
CVE-2020-4031: Use After Free (CWE-416)
value: In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2020-06-22T22:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: server/shadow/shadow_server.c
Commit date: 2020-06-22 11:51:38 +0200
Commit message: Fixed double free

Diff: diff --git a/server/shadow/shadow_server.c b/server/shadow/shadow_server.c
index 30a63c9fa03..259f22ecd14 100644
--- a/server/shadow/shadow_server.c
+++ b/server/shadow/shadow_server.c
@@ -584,18 +584,23 @@ int shadow_server_start(rdpShadowServer* server)
 	{
 		size_t x, count;
 		char** list = CommandLineParseCommaSeparatedValuesEx(NULL, server->ipcSocket, &count);
 		if (!list || (count <= 1))
 		{
-			free(list);
 			if (server->ipcSocket == NULL)
 			{
 				if (!open_port(server, NULL))
+				{
+					free(list);
 					return -1;
+				}
 			}
 			else
+			{
+				free(list);
 				return -1;
+			}
 		}
 
 		for (x = 1; x < count; x++)
 		{
 			BOOL success = open_port(server, list[x]);

Vulnerable code: 			free(list);
Fixed code: 				{
					free(list);
				}
			{
				free(list);
			}
CVE-2020-4032: Incorrect Conversion between Numeric Types (CWE-681)
value: In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.
CWE description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CVSS v3 base score: 4.3
Published: 2020-06-22T22:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/orders.c
Commit date: 2020-06-22 11:51:39 +0200
Commit message: Fixed OOB read in update_recv_secondary_order

CVE-2020-4032 thanks to @antonio-morales for finding this.

Diff: diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
index 744bf3cd6ac..dc4e51a8739 100644
--- a/libfreerdp/core/orders.c
+++ b/libfreerdp/core/orders.c
@@ -3760,16 +3760,17 @@ static BOOL update_recv_secondary_order(rdpUpdate* update, wStream* s, BYTE flag
 	{
 		WLog_Print(update->log, WLOG_WARN, "SECONDARY_ORDER %s: read %" PRIuz "bytes too much",
 		           name, end - start);
 		return FALSE;
 	}
-	diff = start - end;
+	diff = end - start;
 	if (diff > 0)
 	{
 		WLog_Print(update->log, WLOG_DEBUG,
 		           "SECONDARY_ORDER %s: read %" PRIuz "bytes short, skipping", name, diff);
-		Stream_Seek(s, diff);
+		if (!Stream_SafeSeek(s, diff))
+			return FALSE;
 	}
 	return rc;
 }
 
 static BOOL read_altsec_order(wStream* s, BYTE orderType, rdpAltSecUpdate* altsec)

Vulnerable code: 	diff = start - end;
		Stream_Seek(s, diff);
Fixed code: 	diff = end - start;
		if (!Stream_SafeSeek(s, diff))
			return FALSE;
CVE-2021-37594: Improper Input Validation (CWE-20)
value: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2021-07-30T14:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: client/Windows/wf_cliprdr.c
Commit date: 2021-07-22 15:10:18 +0200
Commit message: Fixed missing input checks for file contents request

reported by Valentino Ricotta (Thalium)

Diff: diff --git a/client/Windows/wf_cliprdr.c b/client/Windows/wf_cliprdr.c
index a51d1f71bc2..a8a43c86d32 100644
--- a/client/Windows/wf_cliprdr.c
+++ b/client/Windows/wf_cliprdr.c
@@ -2361,19 +2361,23 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext* context,
 	}
 	else
 	{
 		if (fileContentsRequest->dwFlags == FILECONTENTS_SIZE)
 		{
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			*((UINT32*)&pData[0]) =
 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeLow;
 			*((UINT32*)&pData[4]) =
 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeHigh;
 			uSize = cbRequested;
 		}
 		else if (fileContentsRequest->dwFlags == FILECONTENTS_RANGE)
 		{
 			BOOL bRet;
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			bRet = wf_cliprdr_get_file_contents(
 			    clipboard->file_names[fileContentsRequest->listIndex], pData,
 			    fileContentsRequest->nPositionLow, fileContentsRequest->nPositionHigh, cbRequested,
 			    &uSize);
 

Fixed code: 			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
CVE-2021-37595: Improper Input Validation (CWE-20)
value: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE File Contents Request PDU.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2021-07-30T14:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: client/Windows/wf_cliprdr.c
Commit date: 2021-07-22 15:10:18 +0200
Commit message: Fixed missing input checks for file contents request

reported by Valentino Ricotta (Thalium)

Diff: diff --git a/client/Windows/wf_cliprdr.c b/client/Windows/wf_cliprdr.c
index a51d1f71bc2..a8a43c86d32 100644
--- a/client/Windows/wf_cliprdr.c
+++ b/client/Windows/wf_cliprdr.c
@@ -2361,19 +2361,23 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext* context,
 	}
 	else
 	{
 		if (fileContentsRequest->dwFlags == FILECONTENTS_SIZE)
 		{
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			*((UINT32*)&pData[0]) =
 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeLow;
 			*((UINT32*)&pData[4]) =
 			    clipboard->fileDescriptor[fileContentsRequest->listIndex]->nFileSizeHigh;
 			uSize = cbRequested;
 		}
 		else if (fileContentsRequest->dwFlags == FILECONTENTS_RANGE)
 		{
 			BOOL bRet;
+			if (clipboard->nFiles <= fileContentsRequest->listIndex)
+				goto error;
 			bRet = wf_cliprdr_get_file_contents(
 			    clipboard->file_names[fileContentsRequest->listIndex], pData,
 			    fileContentsRequest->nPositionLow, fileContentsRequest->nPositionHigh, cbRequested,
 			    &uSize);
 

Fixed code: 			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
CVE-2024-22211: Integer Overflow or Wraparound (CWE-190)
value: FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2024-01-19T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/codec/planar.c
Commit date: 2024-01-16 09:02:58 +0100
Commit message: [codec,planar] check resolution for overflow

If the codec resolution is too large return an error as the internal
buffers would otherwise overflow.

Diff: diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
index 37a0ee9f673..619e46031c5 100644
--- a/libfreerdp/codec/planar.c
+++ b/libfreerdp/codec/planar.c
@@ -1653,11 +1653,17 @@ BOOL freerdp_bitmap_planar_context_reset(BITMAP_PLANAR_CONTEXT* context, UINT32
 		return FALSE;
 
 	context->bgr = FALSE;
 	context->maxWidth = PLANAR_ALIGN(width, 4);
 	context->maxHeight = PLANAR_ALIGN(height, 4);
-	context->maxPlaneSize = context->maxWidth * context->maxHeight;
+	const UINT64 tmp = (UINT64)context->maxWidth * context->maxHeight;
+	if (tmp > UINT32_MAX)
+		return FALSE;
+	context->maxPlaneSize = tmp;
+
+	if (context->maxWidth > UINT32_MAX / 4)
+		return FALSE;
 	context->nTempStep = context->maxWidth * 4;
 
 	memset(context->planes, 0, sizeof(context->planes));
 	memset(context->rlePlanes, 0, sizeof(context->rlePlanes));
 	memset(context->deltaPlanes, 0, sizeof(context->deltaPlanes));

Vulnerable code: 	context->maxPlaneSize = context->maxWidth * context->maxHeight;
Fixed code: 	const UINT64 tmp = (UINT64)context->maxWidth * context->maxHeight;
	if (tmp > UINT32_MAX)
		return FALSE;
	context->maxPlaneSize = tmp;

	if (context->maxWidth > UINT32_MAX / 4)
		return FALSE;
CVE-2024-32658: Insufficient Information (NVD-CWE-noinfo)
value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T18:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/codec/interleaved.c
Commit date: 2024-04-20 21:20:44 +0200
Commit message: [codec,interleaved] fix offset error

Diff: diff --git a/libfreerdp/codec/interleaved.c b/libfreerdp/codec/interleaved.c
index fae572b95bd..262895d0293 100644
--- a/libfreerdp/codec/interleaved.c
+++ b/libfreerdp/codec/interleaved.c
@@ -210,11 +210,11 @@ static UINT ExtractRunLengthRegularFgBg(const BYTE* pbOrderHdr, const BYTE* pbEn
 	WINPR_ASSERT(advance);
 
 	runLength = (*pbOrderHdr) & g_MaskRegularRunLength;
 	if (runLength == 0)
 	{
-		if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
+		if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
 		{
 			*advance = 0;
 			return 0;
 		}
 		runLength = *(pbOrderHdr + 1) + 1;
@@ -280,11 +280,11 @@ static UINT ExtractRunLengthMegaMega(const BYTE* pbOrderHdr, const BYTE* pbEnd,
 
 	WINPR_ASSERT(pbOrderHdr);
 	WINPR_ASSERT(pbEnd);
 	WINPR_ASSERT(advance);
 
-	if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
+	if (!buffer_within_range(pbOrderHdr, 3, pbEnd))
 	{
 		*advance = 0;
 		return 0;
 	}
 

Vulnerable code: 		if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
	if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
Fixed code: 		if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
	if (!buffer_within_range(pbOrderHdr, 3, pbEnd))
CVE-2024-32659: Insufficient Information (NVD-CWE-noinfo)
value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/codec/color.c
Commit date: 2024-04-21 11:00:47 +0200
Commit message: [codec,color] fix out of bound read

Diff: diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c
index eb9f7a8bc56..2c3d08a3679 100644
--- a/libfreerdp/codec/color.c
+++ b/libfreerdp/codec/color.c
@@ -845,10 +845,13 @@ BOOL freerdp_image_copy(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT32
 		return FALSE;
 
 	if (!pDstData || !pSrcData)
 		return FALSE;
 
+	if ((nWidth == 0) || (nHeight == 0))
+		return TRUE;
+
 	if (nDstStep == 0)
 		nDstStep = nWidth * FreeRDPGetBytesPerPixel(DstFormat);
 
 	if (nSrcStep == 0)
 		nSrcStep = nWidth * FreeRDPGetBytesPerPixel(SrcFormat);

Fixed code: 	if ((nWidth == 0) || (nHeight == 0))
		return TRUE;
CVE-2024-32661: Insufficient Information (NVD-CWE-noinfo)
value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T20:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/info.c
Commit date: 2024-04-21 14:28:24 +0200
Commit message: [core,info] fix missing check in rdp_write_logon_info_v1

Diff: diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
index 7d6eec13782..3395e4d2e04 100644
--- a/libfreerdp/core/info.c
+++ b/libfreerdp/core/info.c
@@ -1396,10 +1396,14 @@ static BOOL rdp_write_logon_info_v1(wStream* s, logon_info* info)
 
 	if (!Stream_EnsureRemainingCapacity(s, sz))
 		return FALSE;
 
 	/* domain */
+	WINPR_ASSERT(info);
+	if (!info->domain || !info->username)
+		return FALSE;
+
 	len = strnlen(info->domain, charLen + 1);
 	if (len > charLen)
 		return FALSE;
 
 	Stream_Write_UINT32(s, len * sizeof(WCHAR));

Fixed code: 	WINPR_ASSERT(info);
	if (!info->domain || !info->username)
		return FALSE;
CVE-2024-32662: Insufficient Information (NVD-CWE-noinfo)
value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-23T21:15Z
Repository: https://github.com/FreeRDP/FreeRDP
Language: C
Files changed: libfreerdp/core/redirection.c
Commit date: 2024-04-22 11:02:04 +0200
Commit message: [core,redirection] fix length of redirection strings

length field is in bytes, when converting from UCS-2 use size in WCHAR

Diff: diff --git a/libfreerdp/core/redirection.c b/libfreerdp/core/redirection.c
index 8538a905638..5343a071cb5 100644
--- a/libfreerdp/core/redirection.c
+++ b/libfreerdp/core/redirection.c
@@ -241,11 +241,11 @@ static BOOL rdp_redirection_read_base64_wchar(UINT32 flag, wStream* s, UINT32* p
 	if (!rdp_redirection_get_data(s, pLength, &ptr))
 		return FALSE;
 	const WCHAR* wchar = (const WCHAR*)ptr;
 
 	size_t utf8_len = 0;
-	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength, &utf8_len);
+	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength / sizeof(WCHAR), &utf8_len);
 	if (!utf8)
 		goto fail;
 
 	redirection_free_data(pData, NULL);
 

Vulnerable code: 	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength, &utf8_len);
Fixed code: 	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength / sizeof(WCHAR), &utf8_len);
CVE-2010-10007: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the function db_query of the file src/backend/include/BaseAction.php. The manipulation leads to sql injection. The identifier of the patch is 41213b660e8eb01b22c8074f06208f59a73ca8dc. It is recommended to apply a patch to fix this issue. The identifier VDB-218465 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-18T06:15Z
Repository: https://github.com/lierdakil/click-reminder
Language: PHP
Files changed: src/backend/include/BaseAction.php
Commit date: 2010-09-17 16:20:28 +0000
Commit message: Some SQL injection safeguards
Diff: diff --git a/src/backend/include/BaseAction.php b/src/backend/include/BaseAction.php
index 1519196..d8c6615 100644
--- a/src/backend/include/BaseAction.php
+++ b/src/backend/include/BaseAction.php
@@ -34,10 +34,12 @@ class BaseAction {
      * throws exception on unsuccessfull call.
      */
     protected function db_query($query) {
         $query=str_replace("\n","",$query);
         $query=ereg_replace(" +"," ",$query);
+        if(strpos($query, ';') !== false)
+            throw new Exception("Query '$query' contains ';'!", ERR_DB);
         $result = $this->mysql->query($query);
         if ($result === true) {
             if($this->mysql->affected_rows>0)
                 return true;
             else
@@ -100,8 +102,11 @@ class ItemAction extends UserAction {
 
     function  __construct($message) {
         parent::__construct($message);
         $this->iid = $this->getMessageParam('iid',
                 "No IID provided", ERR_NO_IID);
+        #iid MUST be numeric. If not, it's not an IID!
+        if(!is_numeric($this->iid)) 
+            throw new Exception("Malformed IID '$this->iid'!", ERR_NO_IID);
     }
 }
 ?>

Fixed code:         if(strpos($query, ';') !== false)
            throw new Exception("Query '$query' contains ';'!", ERR_DB);
        #iid MUST be numeric. If not, it's not an IID!
        if(!is_numeric($this->iid)) 
            throw new Exception("Malformed IID '$this->iid'!", ERR_NO_IID);
CVE-2022-39217: Other (NVD-CWE-Other)
value: some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version `v1`. Users are advised to use `v1` or later. There are no known workarounds for this issue.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-09-17T00:15Z
Repository: https://github.com/some-natalie/ghas-to-csv
Language: Python
Files changed: requirements.txt, src/code_scanning.py, src/enterprise.py, src/secret_scanning.py
Commit date: 2022-09-07 08:47:32 -0600
Commit message: move from `csv` to `defusedcsv` (#20)


Diff: diff --git a/requirements.txt b/requirements.txt
index d15ce5a..12060f5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1,2 @@
+defusedcsv==2.0.0
 requests==2.28.1
diff --git a/src/code_scanning.py b/src/code_scanning.py
index da63ae5..1a5e5dc 100644
--- a/src/code_scanning.py
+++ b/src/code_scanning.py
@@ -1,9 +1,9 @@
 # This holds all the things that do stuff for code scanning API
 
 # Imports
-import csv
+from defusedcsv import csv
 import requests
 
 
 def list_repo_code_scanning_alerts(api_endpoint, github_pat, repo_name):
     """
diff --git a/src/enterprise.py b/src/enterprise.py
index cc5e793..3692065 100644
--- a/src/enterprise.py
+++ b/src/enterprise.py
@@ -1,9 +1,9 @@
 # This holds all the logic for the various enterprise differences.
 
 # Imports
-import csv
+from defusedcsv import csv
 from time import sleep
 import requests
 
 
 def get_enterprise_version(api_endpoint):
diff --git a/src/secret_scanning.py b/src/secret_scanning.py
index 7c760dc..3528ef3 100644
--- a/src/secret_scanning.py
+++ b/src/secret_scanning.py
@@ -1,9 +1,9 @@
 # This holds all the things that do stuff for secret scanning API
 
 # Imports
-import csv
+from defusedcsv import csv
 import requests
 
 
 def get_repo_secret_scanning_alerts(api_endpoint, github_pat, repo_name):
     """

Vulnerable code: import csv
import csv
import csv
Fixed code: defusedcsv==2.0.0
from defusedcsv import csv
from defusedcsv import csv
from defusedcsv import csv
CVE-2023-0609: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2023-02-01T12:15Z
Repository: https://github.com/wallabag/wallabag
Language: Unknown
Commit date: 2023-02-01 09:30:43 +0100
Commit message: Merge pull request from GHSA-qwx8-mxxx-mg96

ExportController: fix improper authorization vulnerability