Vulnerability Details : CVE-2014-0791
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2014-0791
- cpe:2.3:a:freerdp:freerdp:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:freerdp:freerdp:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:freerdp:freerdp:1.0.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0791
1.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0791
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2014-0791
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0791
-
https://bugzilla.redhat.com/show_bug.cgi?id=998941
998941 – (CVE-2014-0791) CVE-2014-0791 freerdp: integer overflow in heap allocation in license_read_scope_list()
-
http://lists.opensuse.org/opensuse-updates/2016-09/msg00102.html
openSUSE-SU-2016:2402-1: moderate: Security update for freerdp
-
http://advisories.mageia.org/MGASA-2014-0287.html
Mageia Advisory: MGASA-2014-0287 - Updated freerdp packages fix two vulnerabilities
-
https://github.com/FreeRDP/FreeRDP/pull/1649
Fix possible integer overflow in license_read_scope_list() by sidhpurwala-huzaifa · Pull Request #1649 · FreeRDP/FreeRDP · GitHub
-
http://lists.opensuse.org/opensuse-updates/2016-09/msg00101.html
openSUSE-SU-2016:2400-1: moderate: Security update for freerdp
-
http://openwall.com/lists/oss-security/2014/01/03/4
oss-security - Re: CVE for freerdp int overflow?
-
http://lists.opensuse.org/opensuse-updates/2014-07/msg00008.html
openSUSE-SU-2014:0862-1: moderate: freerdp: Fixes for integer overflows
-
https://github.com/sidhpurwala-huzaifa/FreeRDP/commit/e2745807c4c3e0a590c0f69a9b655dc74ebaa03e
Fix possible integer overflow in license_read_scope_list() · sidhpurwala-huzaifa/FreeRDP@e274580 · GitHub
-
https://lists.debian.org/debian-lts-announce/2020/08/msg00054.html
[SECURITY] [DLA 2356-1] freerdp security update
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:171
mandriva.com
-
http://openwall.com/lists/oss-security/2014/01/02/5
oss-security - CVE for freerdp int overflow?
Jump to