CVE-2023-39352 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-39352 Interim 1 2 2023-09-06T23:17:19Z current 2023-09-01T23:17:26Z 2023-09-06T23:17:19Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-39352 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP5 freerdp freerdp-devel freerdp-proxy freerdp-server freerdp-wayland libfreerdp2 libuwac0-0 libwinpr2 uwac0-0-devel winpr2-devel freerdp as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 freerdp-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 freerdp-proxy as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libfreerdp2 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 libwinpr2 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 winpr2-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 freerdp as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 freerdp-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 freerdp-proxy as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 freerdp-server as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 freerdp-wayland as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libfreerdp2 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libuwac0-0 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libwinpr2 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 uwac0-0-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 winpr2-devel as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 freerdp-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libfreerdp2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libwinpr2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 winpr2-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 freerdp as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 freerdp as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp-proxy as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp-server as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libfreerdp2 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libwinpr2 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 freerdp as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 freerdp-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 freerdp-proxy as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 libfreerdp2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 libwinpr2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 winpr2-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP4 freerdp as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 freerdp-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 freerdp-proxy as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 libfreerdp2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 libwinpr2 as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 winpr2-devel as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39352 SUSE Linux Enterprise Module for Package Hub 15 SP4:freerdp SUSE Linux Enterprise Module for Package Hub 15 SP4:freerdp-devel SUSE Linux Enterprise Module for Package Hub 15 SP4:freerdp-proxy SUSE Linux Enterprise Module for Package Hub 15 SP4:libfreerdp2 SUSE Linux Enterprise Module for Package Hub 15 SP4:libwinpr2 SUSE Linux Enterprise Module for Package Hub 15 SP4:winpr2-devel SUSE Linux Enterprise Module for Package Hub 15 SP5:freerdp SUSE Linux Enterprise Module for Package Hub 15 SP5:freerdp-devel SUSE Linux Enterprise Module for Package Hub 15 SP5:freerdp-proxy SUSE Linux Enterprise Module for Package Hub 15 SP5:freerdp-server SUSE Linux Enterprise Module for Package Hub 15 SP5:freerdp-wayland SUSE Linux Enterprise Module for Package Hub 15 SP5:libfreerdp2 SUSE Linux Enterprise Module for Package Hub 15 SP5:libuwac0-0 SUSE Linux Enterprise Module for Package Hub 15 SP5:libwinpr2 SUSE Linux Enterprise Module for Package Hub 15 SP5:uwac0-0-devel SUSE Linux Enterprise Module for Package Hub 15 SP5:winpr2-devel SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2 SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2 SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2 SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2 SUSE Linux Enterprise Workstation Extension 15 SP4:freerdp SUSE Linux Enterprise Workstation Extension 15 SP4:freerdp-devel SUSE Linux Enterprise Workstation Extension 15 SP4:freerdp-proxy SUSE Linux Enterprise Workstation Extension 15 SP4:libfreerdp2 SUSE Linux Enterprise Workstation Extension 15 SP4:libwinpr2 SUSE Linux Enterprise Workstation Extension 15 SP4:winpr2-devel SUSE Linux Enterprise Workstation Extension 15 SP5:freerdp SUSE Linux Enterprise Workstation Extension 15 SP5:freerdp-devel SUSE Linux Enterprise Workstation Extension 15 SP5:freerdp-proxy SUSE Linux Enterprise Workstation Extension 15 SP5:libfreerdp2 SUSE Linux Enterprise Workstation Extension 15 SP5:libwinpr2 SUSE Linux Enterprise Workstation Extension 15 SP5:winpr2-devel moderate 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L