FEDORA-2022-fd6e43dec8 — security update for freerdp

stable

freerdp-2.9.0-1.fc36

FEDORA-2022-fd6e43dec8 created by oholy 10 months ago for Fedora 36

Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319, CVE-2022-39320, CVE-2022-41877 and CVE-2022-39347).

Update to 2.8.1 (CVE-2022-39282, CVE-2022-39283).

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-fd6e43dec8

This update has been submitted for testing by oholy.

10 months ago

This update's test gating status has been changed to 'waiting'.

10 months ago

This update has obsoleted freerdp-2.8.1-1.fc36, and has inherited its bugs and notes.

10 months ago

This update's test gating status has been changed to 'failed'.

10 months ago

This update's test gating status has been changed to 'passed'.

10 months ago

This update has been pushed to testing.

9 months ago

geraldosimiao provided feedback 9 months ago

karma

This update has been submitted for stable by bodhi.

9 months ago

This update has been pushed to stable.

9 months ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

passed

Builds

freerdp-2.9.0-1.fc36

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

10 months ago

in testing

9 months ago

in stable

9 months ago

BZ#2134713 CVE-2022-39282 freerdp: clients using `/parallel` command line switch might read uninitialized data

BZ#2134714 CVE-2022-39282 freerdp: uninitialized reads may lead to compromised confidentiality [fedora-all]

BZ#2134717 CVE-2022-39283 freerdp: clients using the `/video` command line switch might read uninitialized data

BZ#2134718 CVE-2022-39283 freerdp: uninitialized reads may lead to compromised confidentiality [fedora-all]

BZ#2143642 CVE-2022-39316 freerdp: out of bounds read in zgfx decoder

BZ#2143643 CVE-2022-39317 freerdp: undefined behaviour in zgfx decoder

BZ#2143644 CVE-2022-39318 freerdp: division by zero in urbdrc channel

BZ#2143645 CVE-2022-39319 freerdp: missing length validation in urbdrc channel

BZ#2143646 CVE-2022-39320 freerdp: heap buffer overflow in urbdrc channel

BZ#2143647 CVE-2022-39347 freerdp: missing path sanitation with `drive` channel

BZ#2143648 CVE-2022-41877 freerdp: missing input length validation in `drive` channel

BZ#2143652 CVE-2022-39316 freerdp: out of bounds read in zgfx decoder [fedora-36]

BZ#2143656 CVE-2022-39317 freerdp: undefined behaviour in zgfx decoder [fedora-36]

BZ#2143660 CVE-2022-39320 freerdp: heap buffer overflow in urbdrc channel [fedora-36]

BZ#2143669 CVE-2022-39318 freerdp: division by zero in urbdrc channel [fedora-36]

BZ#2143670 CVE-2022-39347 freerdp: missing path sanitation with `drive` channel [fedora-36]

BZ#2143671 CVE-2022-41877 freerdp: missing input length validation in `drive` channel [fedora-36]

BZ#2143676 CVE-2022-39319 freerdp: missing length validation in urbdrc channel [fedora-36]

freerdp-2.9.0-1.fc36

Automated Test Results

passed