Vulnerability Details : CVE-2019-17177

libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.

Published 2019-10-04 17:15:10

Updated 2021-07-21 11:39:24

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-17177

Probability of exploitation activity in the next 30 days: 0.85%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 80 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-17177

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	[email protected]
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-17177

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Assigned by: [email protected] (Primary)

References for CVE-2019-17177

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html

Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.html

Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4379-1/

Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202005-07

Third Party Advisory
https://github.com/FreeRDP/FreeRDP/issues/5645

Third Party Advisory

CVEs referencing this url
https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a

Patch;Vendor Advisory

CVEs referencing this url

Products affected by CVE-2019-17177

Opensuse » Leap » Version: 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp
Versions up to, including, (<=) 1.0.2
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update Beta1
cpe:2.3:a:freerdp:freerdp:2.0.0:beta1:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update RC0
cpe:2.3:a:freerdp:freerdp:2.0.0:rc0:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update RC1
cpe:2.3:a:freerdp:freerdp:2.0.0:rc1:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update RC2
cpe:2.3:a:freerdp:freerdp:2.0.0:rc2:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update RC3
cpe:2.3:a:freerdp:freerdp:2.0.0:rc3:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 1.1.0 Update Beta1
cpe:2.3:a:freerdp:freerdp:1.1.0:beta1:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 1.1.0 Update Beta
cpe:2.3:a:freerdp:freerdp:1.1.0:beta:*:*:*:*:*:*
Matching versions
Freerdp » Freerdp » Version: 2.0.0 Update RC4
cpe:2.3:a:freerdp:freerdp:2.0.0:rc4:*:*:*:*:*:*
Matching versions