CVE-2024-32040
Publication date 23 April 2024
Last updated 24 July 2024
Ubuntu priority
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
Why is this CVE low priority?
FreeRDP developers have rated this as being a low severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| freerdp2 | 24.10 oracular |
Vulnerable
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy |
Fixed 2.6.1+dfsg1-3ubuntu2.6
|
|
| 20.04 LTS focal |
Fixed 2.6.1+dfsg1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| freerdp3 | 24.10 oracular |
Fixed 3.5.0+dfsg1-0ubuntu1
|
| 24.04 LTS noble |
Fixed 3.5.0+dfsg1-0ubuntu1
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release |
References
Related Ubuntu Security Notices (USN)
- USN-6749-1
- FreeRDP vulnerabilities
- 24 April 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-32040
- https://www.freerdp.com/2024/04/17/2_11_6-release
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0