CVE-2024-32460
Publication date 23 April 2024
Last updated 24 July 2024
Ubuntu priority
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
Why is this CVE low priority?
FreeRDP developers have rated this as being a low severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| freerdp2 | 24.10 oracular |
Vulnerable
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy |
Fixed 2.6.1+dfsg1-3ubuntu2.6
|
|
| 20.04 LTS focal |
Fixed 2.6.1+dfsg1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| freerdp3 | 24.10 oracular |
Fixed 3.5.0+dfsg1-0ubuntu1
|
| 24.04 LTS noble |
Fixed 3.5.0+dfsg1-0ubuntu1
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release |
References
Related Ubuntu Security Notices (USN)
- USN-6749-1
- FreeRDP vulnerabilities
- 24 April 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-32460
- https://www.freerdp.com/2024/04/17/2_11_6-release
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0