Vulnerability Details : CVE-2023-40186
Potential exploit
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2023-40186
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
- cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
- cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40186
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40186
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
3.9
|
2.5
|
GitHub, Inc. |
CWE ids for CVE-2023-40186
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2023-40186
-
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v
IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface · Advisory · FreeRDP/FreeRDP · GitHubExploit;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/
[SECURITY] Fedora 39 Update: freerdp-2.11.1-1.fc39 - package-announce - Fedora Mailing-ListsMailing List
-
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
[SECURITY] [DLA 3606-1] freerdp2 security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/
[SECURITY] Fedora 37 Update: freerdp-2.11.1-1.fc37 - package-announce - Fedora Mailing-ListsMailing List
-
https://security.gentoo.org/glsa/202401-16
FreeRDP: Multiple Vulnerabilities (GLSA 202401-16) — Gentoo security
-
https://github.com/FreeRDP/FreeRDP/blob/fee2b10ba1154f952769a53eb608f044782e22f8/libfreerdp/gdi/gfx.c#L1156-L1165
FreeRDP/libfreerdp/gdi/gfx.c at fee2b10ba1154f952769a53eb608f044782e22f8 · FreeRDP/FreeRDP · GitHubIssue Tracking
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/
[SECURITY] Fedora 38 Update: freerdp-2.11.1-1.fc38 - package-announce - Fedora Mailing-ListsMailing List
Jump to