CVE-2024-32039
Publication date 23 April 2024
Last updated 24 July 2024
Ubuntu priority
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| freerdp2 | 24.10 oracular |
Vulnerable
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy |
Fixed 2.6.1+dfsg1-3ubuntu2.6
|
|
| 20.04 LTS focal |
Fixed 2.6.1+dfsg1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| freerdp3 | 24.10 oracular |
Fixed 3.5.0+dfsg1-0ubuntu1
|
| 24.04 LTS noble |
Fixed 3.5.0+dfsg1-0ubuntu1
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release |
References
Related Ubuntu Security Notices (USN)
- USN-6749-1
- FreeRDP vulnerabilities
- 24 April 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-32039
- https://www.freerdp.com/2024/04/17/2_11_6-release
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0