CVE-2018-8785: canonical ubuntu_linux Classic Buffer Overflow
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2018-8785DEBIAN-CVE-2018-8785
Published 29-11-2018Last modified 16-09-2024
Vulnerability summary
CVE-2018-8785 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in canonical ubuntu_linux. EPSS estimates a 7.29% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
7.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 29-11-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption and probably even a remote code execution.
CVSS metrics
5 scores · 3 sources · 3 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Critical 9.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.29%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.29% on 19-09-2026
19-09-202619-10-2026
EPSS score7.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (research.checkpoint.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Canonical1 product
- ubuntu_linuxEOL18.04 | 18.10
Check point software technologies ltd.1 product
- freerdpAll versions prior to 2.0.0-rc4
Debian1 product
- freerdp2< 2.0.0~git20181120.1.e21b72c95+dfsg1-1
Freerdp1 product
- freerdp≤ 1.2.0 | 2.0.0:rc1 | 2.0.0:rc2 | 2.0.0:rc3
Ubuntu1 product
- freerdp2< 2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1
5 vendors · 5 products
References
8 links- github.com/FreeRDP/FreeRDP/commit/602f4a2e14b41703b5f431de3154cd46a5750a2dX Refsource CONFIRMPatchVendor AdvisoryREPORT
- research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/X Refsource CONFIRMExploitThird Party Advisory
