Headline

CVE-2020-11038: Integer overflow in VIDEO channel

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.

5 years ago

CVE

Open in Source

#vulnerability #git #buffer_overflow

- Actions
  
  Automate any workflow
- Packages
  
  Host and manage packages
- Security
  
  Find and fix vulnerabilities
- Codespaces
  
  Instant dev environments
- Copilot
  
  Write better code with AI
- Code review
  
  Manage code changes
- Issues
  
  Plan and track work
- Discussions
  
  Collaborate outside of code

- GitHub Sponsors
  
  Fund open source developers

*   The ReadME Project
    
    GitHub community articles

Pricing

Affected versions

<= 2.0.0

Description

Impact

All FreeRDP clients, all platforms

When using /video redirection a manipulated server can instruct the client to allocate a buffer which is allocated with a smaller size than requested due to an integer overflow in size calculation.
With later messages the server can manipulate the client to write data out of bound to the previously allocated buffer.

Workarounds

Deactivate VIDEO redirection client side, don´ t use /video

References