CVE-2022-39283

NameCVE-2022-39283
DescriptionFreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3654-1, DLA-4053-1
Debian Bugs1021659

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
freerdp2 (PTS)bullseye2.3.0+dfsg1-2+deb11u1vulnerable
bullseye (security)2.3.0+dfsg1-2+deb11u2fixed
bookworm2.10.0+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
freerdp2sourcebuster2.3.0+dfsg1-2+deb10u4DLA-3654-1
freerdp2sourcebullseye2.3.0+dfsg1-2+deb11u2DLA-4053-1
freerdp2source(unstable)2.8.1+dfsg1-11021659

Notes

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh
patch likely: https://github.com/FreeRDP/FreeRDP/commit/be793c3bb776c1bbda9156b427408d5a5eb00f70 (not confirmed by upstream)
Search for package or bug name: Reporting problems