huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-10757: kernel: kernel: DAX hugepages not considered during mremap
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-06-04T09:00:00+00:00

A flaw was found in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.

Statement: This issue requires access to a DAX enabled storage.

This issue affects Red Hat Enterprise Linux 7 kernels starting with kernel-3.10.0-862, that is Red Hat Enterprise Linux 7.5 GA kernel. Red Hat Enterprise Linux 7 kernels prior to that version are not affected as they did not include the functionality that enabled this issue to be exploited.

Red Hat Product Security is aware of this issue. Updates will be released as they become available.

Affected upstream versions: All versions after 4.5-rc1.
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5bfea2d9b17f1034a68147a8b03b9789af5700f9
CVE-2020-10758: keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body
Component: keycloak
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-08-18T00:00:00+00:00

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availability.


Affected upstream versions: Keycloak before 11.0.1
Fixed upstream versions: 11.0.1
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: bee4ca89897766c4b68856eafe14f1a3dad34251
CVE-2020-10766: kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.
Component: kernel
Severity: Important
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-06-09T17:00:00+00:00

A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.

Statement: This flaw is rated as having Important impact because it can be used to disable Spectre v4, which has a rating of Important.

Affected upstream versions: before 5.8-rc1
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: dbbe2ad02e9df26e372f38cc3e70dab9222c832e
CVE-2020-10767: kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is available.
Component: kernel
Severity: Important
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-06-09T14:00:00+00:00

A flaw was found in the Linux kernel’s implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.

Statement: This flaw is rated as having Important impact, because it enables exploitation of the previous Spectre v2 attack, which has a rating of Important.

Affected upstream versions: before 5.8-rc1
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 21998a351512eba4ed5969006f0c55882d995ada
CVE-2020-10768: kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.
Component: kernel
Severity: Important
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-06-09T14:00:00+00:00

A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

Statement: This flaw is rated as having Important impact, because it enables exploitation of the previous Spectre v2 attack, which has a rating of Important.

Affected upstream versions: before 5.8-rc1
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4d8df8cbb9156b0a0ab3f802b80cb5db57acc0bf
CVE-2020-10773: kernel: kernel stack information leak on s390/s390x
Component: kernel
Severity: Low
CWE: CWE-626 (Null Byte Interaction Error (Poison Null Byte))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-10-28T14:00:00+00:00

A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.

Statement: This issue is rated as having Low impact because of being limited to only s390 architecture and very limited kernel stack exposure.

Affected upstream versions: kernel-5.4-rc6
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f
CVE-2020-10878: perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS
Component: perl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2020-06-02T00:00:00+00:00

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Statement: This flaw is an integer overflow triggered when an application compiles a specially crafted, untrusted regular expression pattern supplied by a user, as most applications match untrusted data against a trusted regex pattern.The flaw leads to a corruption of the intermediate language state. While this could theoretically allow an attacker to insert instructions, the resulting behavior is unpredictable, and any potential code execution is likely outside of an attacker's reliable control. Therefore, the most probable and practical impact is an application crash, resulting in a Denial of Service (DoS).

Affected upstream versions: n/a
Fixed upstream versions: v5.30.3
Upstream repository: https://github.com/perl/perl5
Upstream fix commit: 0a320d753fe7fca03df259a4dfd8e641e51edaa8
CVE-2020-11008: git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak
Component: git
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-04-20T18:00:00+00:00

A flaw was found in git where credentials can be leaked through the use of a crafted URL. The crafted URL must contain a newline, empty host, or lack a scheme so that the credential helper is fulled into giving the information of a different host to the client. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat Enterprise Linux 6 is not affected by this flaw as the vulnerable version of git, version 1.7.9-rc0 and later, was never made available for this product.

Affected upstream versions: < 2.17.5, >= 2.18.0, < 2.18.4, >= 2.19.0, 2.19.5, >= 2.20.0, < 2.20.4, >= 2.21.0, < 2.21.3, >= 2.22.0, < 2.22.4, >= 2.23.0, < 2.23.3, >= 2.24.0, < 2.24.3, >= 2.25.0, < 2.25.4, >= 2.26.0, < 2.26.2
Fixed upstream versions: v2.17.5
Upstream repository: https://github.com/git/git
Upstream fix commit: c44088ecc4b0722636e0a305f9608d3047197282
CVE-2020-11022: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
Component: jquery
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2020-04-23T00:00:00+00:00

A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.

Statement: No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.

Affected upstream versions: >= 1.12.0, < 3.5.0
Fixed upstream versions: 3.5.0
Upstream repository: https://github.com/jquery/jquery
Upstream fix commit: 1d61fd9407e6fbe82fe55cb0b938307aa0791f77
CVE-2020-11042: freerdp: out-of-bounds read in update_read_icon_info function
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-03-31T00:00:00+00:00

In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.


Affected upstream versions: > 1.1, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 6b2bc41935e53b0034fe5948aeeab4f32e80f30f
CVE-2020-11044: freerdp: double free in update_read_cache_bitmap_v3_order function
Component: freerdp
Severity: Low
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-03-31T00:00:00+00:00

In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.


Affected upstream versions: > 1.2, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 67c2aa52b2ae0341d469071d1bc8aab91f8d2ed8
CVE-2020-11045: freerdp: out of bounds read in update_read_bitmap_data function
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-03-30T00:00:00+00:00

In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.


Affected upstream versions: > 1.0, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: f8890a645c221823ac133dbf991f8a65ae50d637
CVE-2020-11046: freerdp: out of bounds seek in update_read_synchronize function could lead out of bounds read
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-03-30T00:00:00+00:00

In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.


Affected upstream versions: > 1.0, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: ed53cd148f43cbab905eaa0f5308c2bf3c48cc37
CVE-2020-11047: freerdp: out-of-bounds read in autodetect_recv_bandwidth_measure_results function
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-04-09T00:00:00+00:00

In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.


Affected upstream versions: > 1.1, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: f5e73cc7c9cd973b516a618da877c87b80950b65
CVE-2020-11048: freerdp: out-of-bounds read could result in aborting the session
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-04-09T00:00:00+00:00

In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.


Affected upstream versions: > 1.0, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 9301bfe730c66180263248b74353daa99f5a969b
CVE-2020-11049: freerdp: out-of-bound read of client memory that is then passed on to the protocol parser
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-04-09T00:00:00+00:00

In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.


Affected upstream versions: > 1.1, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: c367f65d42e0d2e1ca248998175180aa9c2eacd0
CVE-2020-11058: freerdp: stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-04-09T00:00:00+00:00

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.


Affected upstream versions: > 1.1, < 2.0.0
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 3627aaf7d289315b614a584afb388f04abfb5bbf
CVE-2020-11078: python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
Component: python-httplib2
Severity: Moderate
CWE: CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'))
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)
Public date: 2020-05-20T00:00:00+00:00

A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.

Statement: While Red Hat Quay 3.0, and 3.1 used the httplib2 library it was removed in versions 3.2 and later. Upgrade to 3.2 or later to fix this vulnerability in Red Hat Quay.

Red Hat Gluster Storage 3 delivers the affected version of the python-httplib2 library. However the library is not used by Gluster hence the impact by this vulnerability is low.

This issue affects the version of the python-httplib2 library as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.

There's currently no known vector to exploit this when using Python versions with CVE-2019-9740 and CVE-2019-9947 fixed.

In Red Hat OpenStack Platform13, because the flaw has a lower impact and the package's indirect usage in RHOSP cannot be exploited, no update will be provided at this time for the RHOSP python-httplib2 package.

Affected upstream versions: < 0.81.0
Fixed upstream versions: v0.18.0
Upstream repository: https://github.com/httplib2/httplib2
Upstream fix commit: a1457cc31f3206cf691d11d2bf34e98865873e9e
CVE-2020-11080: nghttp2: overly large SETTINGS frames can lead to DoS
Component: nghttp2
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-06-02T00:00:00+00:00

A resource consumption vulnerability was found in nghttp2. This flaw allows an attacker to repeatedly construct an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes that causes excessive CPU usage, leading to a denial of service.


Affected upstream versions: < 1.41.0
Fixed upstream versions: v1.41.0
Upstream repository: https://github.com/nghttp2/nghttp2
Upstream fix commit: 336a98feb0d56b9ac54e12736b18785c27f75090
CVE-2020-11085: freerdp: out-of-bounds read in cliprdr_read_format_list function
Component: freerdp
Severity: Low
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2020-05-29T00:00:00+00:00

In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0.


Affected upstream versions: < 2.1.0
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: b73143cf7ee5fe4cdabcbf56908aa15d8a883821
CVE-2020-11086: freerdp: out-of-bounds read in ntlm_read_ntlm_v2_client_challenge function
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-05-29T00:00:00+00:00

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0.


Affected upstream versions: <= 2.0.0
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: c098f21fdaadca57ff649eee1674f6cc321a2ec4
CVE-2020-11087: freerdp: out-of-bounds read in ntlm_read_AuthenticateMessage
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-05-29T00:00:00+00:00

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0.


Affected upstream versions: <= 2.0.0
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 8241ab42fdf0cc89cf69fc574bf6360c9977a0d4
CVE-2020-11088: freerdp: out-of-bounds read in ntlm_read_NegotiateMessage
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-05-29T00:00:00+00:00

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.


Affected upstream versions: <= 2.0.0
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 8fa38359634a9910b91719818ab02f23c320dbae
CVE-2020-11089: freerdp: out-of-bounds read in irp functions
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2020-05-29T00:00:00+00:00

In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.


Affected upstream versions: < 2.1.0
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 6b485b146a1b9d6ce72dfd7b5f36456c166e7a16
CVE-2020-11095: freerdp: out of bound reads resulting in accessing memory location outside of static array PRIMARY_DRAWING_ORDER_FIELD_BYTES
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 733ee3208306b1ea32697b356c0215180fc3f049
CVE-2020-11096: freerdp: out-of-bound read in update_read_cache_bitmap_v3_order
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: b8beb55913471952f92770c90c372139d78c16c0
CVE-2020-11097: freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 58a3122250d54de3a944c487776bcd4d1da4721e
CVE-2020-11098: freerdp: out-of-bound read in glyph_cache_put
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: c0fd449ec0870b050d350d6d844b1ea6dad4bc7d
CVE-2020-11099: freerdp: out of bounds read in license_read_new_or_upgrade_license_packet
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 6ade7b4cbfd71c54b3d724e8f2d6ac76a58e879a