[Git][security-tracker-team/security-tracker][master] Update information on freerdp3 entries
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Sep 5 06:30:31 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d4d93e4b by Salvatore Bonaccorso at 2026-09-05T07:29:37+02:00
Update information on freerdp3 entries
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1171,99 +1171,99 @@ CVE-2026-85091 (zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overfl
NOTE: https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
NOTE: https://github.com/madler/zlib/commit/e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca
TODO: check details
-CVE-2026-XXXX [FreeRDP server DRDYNVC parser use-after-free during concurrent channel close]
+CVE-2026-XXXX [GHSA-6mpx-c8rj-whj5: FreeRDP server DRDYNVC parser use-after-free during concurrent channel close]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6mpx-c8rj-whj5
NOTE: https://www.openwall.com/lists/oss-security/2026/09/01/2
-CVE-2026-XXXX [FreeRDP RDPGFX ResetGraphics discloses up to 300 bytes of uninitialized heap memory]
+CVE-2026-XXXX [GHSA-r7jx-j9h7-j4xj: FreeRDP RDPGFX ResetGraphics discloses up to 300 bytes of uninitialized heap memory]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj
NOTE: https://www.openwall.com/lists/oss-security/2026/09/01/2
-CVE-2026-XXXX [Smartcard response lengths are not bounded to their inline ATR arrays]
+CVE-2026-XXXX [GHSA-q65v-4w7q-hx3r: Smartcard response lengths are not bounded to their inline ATR arrays]
- freerdp3 3.31.0+dfsg-1
[trixie] - freerdp3 <not-affected> (Only affects 3.28 and later)
- freerdp2 <not-affected> (Only affects 3.28 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r
NOTE: https://www.openwall.com/lists/oss-security/2026/09/01/2
-CVE-2026-XXXX [SHOW_PROTOCOL live-pointer overwrite]
+CVE-2026-XXXX [GHSA-9jcm-x588-gh26: SHOW_PROTOCOL live-pointer overwrite]
- freerdp3 3.31.0+dfsg-1
[trixie] - freerdp3 <not-affected> (Only affects 3.28 and later)
- freerdp2 <not-affected> (Only affects 3.28 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26
NOTE: https://www.openwall.com/lists/oss-security/2026/09/01/2
-CVE-2026-XXXX [FreeRDP server continues after negotiation failure and dispatches a failure code as RDSTLS]
+CVE-2026-XXXX [GHSA-x7v6-xfx3-52j6: FreeRDP server continues after negotiation failure and dispatches a failure code as RDSTLS]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <not-affected> (Only affects 3.0 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
NOTE: https://www.openwall.com/lists/oss-security/2026/09/01/2
-CVE-2026-XXXX [RDPDR out-of-bounds read in rdpdr_dump_packet via UINT32 wraparound in 16 + computerNameLen guard]
+CVE-2026-XXXX [GHSA-c5gr-hmqp-pwj4: RDPDR out-of-bounds read in rdpdr_dump_packet via UINT32 wraparound in 16 + computerNameLen guard]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4
-CVE-2026-XXXX [Out-of-bounds write in urb_send_current_frame_number_result]
+CVE-2026-XXXX [GHSA-h5w2-q35j-443h: Out-of-bounds write in urb_send_current_frame_number_result]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <not-affected> (Only affects 3.14 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h5w2-q35j-443h
-CVE-2026-XXXX [Infinite loop / CPU DoS in pool_decode_rect]
+CVE-2026-XXXX [GHSA-m85m-3qxv-63h5: Infinite loop / CPU DoS in pool_decode_rect]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <not-affected> (Only affects 3.11 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m85m-3qxv-63h5
-CVE-2026-XXXX [Heap buffer overflow in nego_send_negotiation_request via oversized LB_LOAD_BALANCE_INFO routing token]
+CVE-2026-XXXX [GHSA-r9pv-ffph-6gg6: Heap buffer overflow in nego_send_negotiation_request via oversized LB_LOAD_BALANCE_INFO routing token]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r9pv-ffph-6gg6
-CVE-2026-XXXX [NULL pointer dereference in gdi_surface_bits when the client has not enabled NSCodec]
+CVE-2026-XXXX [GHSA-ffjr-p229-hpch: NULL pointer dereference in gdi_surface_bits when the client has not enabled NSCodec]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ffjr-p229-hpch
-CVE-2026-XXXX [FreeRDP: server stores client Core Data DesktopWidth/Height unvalidated in GCC negotiation]
+CVE-2026-XXXX [GHSA-4464-r7qj-pgrx: FreeRDP: server stores client Core Data DesktopWidth/Height unvalidated in GCC negotiation]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4464-r7qj-pgrx
-CVE-2026-XXXX [URBDRC out-of-bounds read in func_get_ep_desc via InterfaceNumber/array-position index mismatch]
+CVE-2026-XXXX [GHSA-hg4r-vv53-vwf8: URBDRC out-of-bounds read in func_get_ep_desc via InterfaceNumber/array-position index mismatch]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg4r-vv53-vwf8
-CVE-2026-XXXX [Client-side heap OOB read in FreeRDP AVC444 chroma combine]
+CVE-2026-XXXX [GHSA-57h7-vw2f-2f9x: Client-side heap OOB read in FreeRDP AVC444 chroma combine]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-57h7-vw2f-2f9x
-CVE-2026-XXXX [Uninitialised heap disclosure in FreeRDP Save Session Info PDU]
+CVE-2026-XXXX [GHSA-v649-94v2-p72q: Uninitialised heap disclosure in FreeRDP Save Session Info PDU]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q
-CVE-2026-XXXX [channels,smartcard worker creation failure frees a devman-owned device]
+CVE-2026-XXXX [GHSA-j5mq-3349-gwmm: channels,smartcard worker creation failure frees a devman-owned device]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j5mq-3349-gwmm
-CVE-2026-XXXX [Unbounded MonitorIds used as an array index in X11 monitor selection]
+CVE-2026-XXXX [GHSA-23pf-q83q-x45r: Unbounded MonitorIds used as an array index in X11 monitor selection]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <not-affected> (Only affects 3.11 and later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23pf-q83q-x45r
-CVE-2026-XXXX [rts_read_result length-checks 2 bytes and then reads 4]
+CVE-2026-XXXX [GHSA-pj8w-fh79-f438: rts_read_result length-checks 2 bytes and then reads 4]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pj8w-fh79-f438
-CVE-2026-XXXX [Stream_EnsureCapacity still overflows]
+CVE-2026-XXXX [GHSA-vccg-35r5-8jrf: Stream_EnsureCapacity still overflows]
- freerdp3 3.31.0+dfsg-1
[trixie] - freerdp3 <not-affected> (Incomplete fix for CVE-2026-27951 never backported)
- freerdp2 <not-affected> (Incomplete fix for CVE-2026-27951 never backported)
- NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w9qg-g24r-77f6
-CVE-2026-XXXX [URBDRC/libusb control-transfer path aborts on reachable OutputBufferSize assertion]
+ NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vccg-35r5-8jrf
+CVE-2026-XXXX [GHSA-w9qg-g24r-77f6: URBDRC/libusb control-transfer path aborts on reachable OutputBufferSize assertion]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w9qg-g24r-77f6
-CVE-2026-XXXX [audin Apple backends perform overflow-prone buffer size arithmetic from server-controlled values]
+CVE-2026-XXXX [GHSA-f5p6-88mh-59vg: audin Apple backends perform overflow-prone buffer size arithmetic from server-controlled values]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f5p6-88mh-59vg
-CVE-2026-XXXX [Disclosure of uninitialized heap memory in the urbdrc USB redirection path]
+CVE-2026-XXXX [GHSA-hw7p-5h2r-83gq: Disclosure of uninitialized heap memory in the urbdrc USB redirection path]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq
-CVE-2026-XXXX [Heap buffer overflow in nego_send_negotiation_request]
+CVE-2026-XXXX [GHSA-2vf2-grvj-6g8x: Heap buffer overflow in nego_send_negotiation_request]
- freerdp3 3.31.0+dfsg-1
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2vf2-grvj-6g8x
@@ -146878,6 +146878,8 @@ CVE-2026-27951 (FreeRDP is a free implementation of the Remote Desktop Protocol.
[bookworm] - freerdp2 <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcfc-ghxr-h927
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113 (3.23.0)
+ NOTE: When fixing this issue the fix needs to be made complete to not open up
+ NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vccg-35r5-8jrf
CVE-2026-27950 (FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...)
- freerdp3 3.23.0+dfsg-1
[trixie] - freerdp3 <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d4d93e4b4d2b2d10bdf94eef1640136a3babe853
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d4d93e4b4d2b2d10bdf94eef1640136a3babe853
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260905/a27329d5/attachment.htm>
More information about the debian-security-tracker-commits
mailing list