Vulnerability Description
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Freerdp | Freerdp | < 2.1.2 |
| Fedoraproject | Fedora | 31 |
| Opensuse | Leap | 15.1 |
| Canonical | Ubuntu Linux | 18.04 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing ListThird Party Advisory
- http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease NotesVendor Advisory
- https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074ePatchThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/4481-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing ListThird Party Advisory
- http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease NotesVendor Advisory
- https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074ePatchThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2020-4030?
CVE-2020-4030 is a vulnerability with a CVSS score of 3.5 (LOW). In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
How severe is CVE-2020-4030?
CVE-2020-4030 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-4030?
Check the references section above for vendor advisories and patch information. Affected products include: Freerdp Freerdp, Fedoraproject Fedora, Opensuse Leap, Canonical Ubuntu Linux, Debian Debian Linux.