Vulnerability Details CVE-2020-11018
In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 44.9%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8cvc-vcw7-6mfw
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8cvc-vcw7-6mfw
- https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
Products affected by CVE-2020-11018
-
cpe:2.3:a:freerdp:freerdp:-
-
cpe:2.3:a:freerdp:freerdp:1.0.0
-
cpe:2.3:a:freerdp:freerdp:1.0.1
-
cpe:2.3:a:freerdp:freerdp:1.0.2
-
cpe:2.3:a:freerdp:freerdp:1.1.0
-
cpe:2.3:a:freerdp:freerdp:1.2.0
-
cpe:2.3:a:freerdp:freerdp:2.0.0
-
cpe:2.3:o:debian:debian_linux:10.0
-
cpe:2.3:o:opensuse:leap:15.1