{"schemaVersion":3,"id":"MGASA-2023-0318","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated freerdp packages fix security vulnerabilities\n\nThis issue affects Clients only:  Integer underflow leading to DOS (e.g.\nabort due to `WINPR_ASSERT` with default compilation flags). When an\ninsufficient blockLen is provided, and proper length validation is not\nperformed, an Integer Underflow occurs, leading to a Denial of Service\n(DOS) vulnerability. (CVE-2023-39350)\n\n\nAffected versions of FreeRDP are subject to a Null Pointer Dereference\nleading a crash in the RemoteFX (rfx) handling. Inside the\n`rfx_process_message_tileset` function, the program allocates tiles\nusing `rfx_allocate_tiles` for the number of numTiles. If the\ninitialization process of tiles is not completed for various reasons,\ntiles will have a NULL pointer. Which may be accessed in further\nprocessing and would cause a program crash. (CVE-2023-39351)\n\nAffected versions are subject to a missing offset validation leading to\nOut Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and\n`tile->quantIdxCr`. As a result crafted input can lead to an out of\nbounds read access which in turn will cause a crash. (CVE-2023-39353)\n\nAffected versions are subject to an Out-Of-Bounds Read in the\n`nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs\nbecause it processes `context->Planes` without checking if it contains\ndata of sufficient length. Should an attacker be able to leverage this\nvulnerability they may be able to cause a crash. (CVE-2023-39354)\n\nAffected versions are subject to an Integer-Underflow leading to\nOut-Of-Bound Read in the `zgfx_decompress_segment` function. In the\ncontext of `CopyMemory`, it's possible to read data beyond the\ntransmitted packet range and likely cause a crash. (CVE-2023-40181)\n\nAffected versions are subject to an IntegerOverflow leading to\nOut-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function.\nThis issue affects FreeRDP based clients only. FreeRDP proxies are not\naffected as image decoding is not done by a proxy. (CVE-2023-40186)\n\nAffected versions are subject to an Out-Of-Bounds Read in the\n`general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because\nprocessing is done on the `in` variable without checking if it contains\ndata of sufficient length. Insufficient data for the `in` variable may\ncause errors or crashes. (CVE-2023-40188)\n\nAffected versions are subject to an Out-Of-Bounds Write in the\n`clear_decompress_bands_data` function in which there is no offset\nvalidation. Abuse of this vulnerability may lead to an out of bounds\nwrite. (CVE-2023-40567)\n\nAffected versions are subject to an Out-Of-Bounds Write in the\n`progressive_decompress` function. This issue is likely down to\nincorrect calculations of the `nXSrc` and `nYSrc` variables.\n(CVE-2023-40569)\n\nIn affected versions there is a Global-Buffer-Overflow in the\nncrush_decompress function. Feeding crafted input into this function can\ntrigger the overflow which has only been shown to cause a crash.\n(CVE-2023-40589)","dates":{"published":"2023-11-15T11:35:09.000Z","modified":"2026-04-16T04:43:02.331Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"freerdp","name":"freerdp","label":"freerdp","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/freerdp","purlType":"rpm","versions":[{"text":"< 2.9.0-1.2.mga8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-1.2.mga8","eol":null,"hubHref":null},{"vendor":"mageia","product":"freerdp","name":"freerdp","label":"freerdp","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/freerdp","purlType":"rpm","versions":[{"text":"< 2.10.0-2.1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.10.0-2.1.mga9","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2023-0318.html","label":"advisories.mageia.org/MGASA-2023-0318.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32360","label":"bugs.mageia.org/show_bug.cgi?id=32360","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-6401-1","label":"ubuntu.com/security/notices/USN-6401-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":["CVE-2023-39350","CVE-2023-39351","CVE-2023-39353","CVE-2023-39354","CVE-2023-40181","CVE-2023-40186","CVE-2023-40188","CVE-2023-40567","CVE-2023-40569","CVE-2023-40589"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-11-15T11:35:09.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T04:43:02.331Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T04:25:02.469Z","stale":false,"partial":false}}