freerdp-2.11.7-3.el8_10
エラータID: AXSA:2026-228:04
リリース日:
2026/02/27 Friday - 14:43
題名:
freerdp-2.11.7-3.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- FreeRDP には、メモリ領域の範囲外読み取りの問題があるため、
リモートの攻撃者により、情報の漏洩、およびサービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2026-22855)
- FreeRDP の Base64 デコード処理には、char 型の符号の有無の
取り違えに起因したメモリ領域の範囲外書き込みの問題があるため、
リモートの攻撃者により、情報の漏洩、およびサービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2026-22858)
- FreeRDP には、メモリ領域の範囲外読み取りの問題があるため、
リモートの攻撃者により、情報の漏洩、およびサービス拒否攻撃を
可能とする脆弱性が存在します。(CVE-2026-22859)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-22855
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This vulnerability is fixed in 3.20.1.
CVE-2026-22858
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check. As a result, non-ASCII bytes (e.g., 0x80-0xFF) may bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access. This vulnerability is fixed in 3.20.1.
CVE-2026-22859
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read. This vulnerability is fixed in 3.20.1.
追加情報:
N/A
ダウンロード:
SRPMS
- freerdp-2.11.7-3.el8_10.src.rpm
MD5: f7ba157bdd8dd0c87053535cab8b38f4
SHA-256: 8ba7a760485b9a36691efdf348b9dd24c6d7822a0856788902049f4b2075ea56
Size: 7.01 MB
Asianux Server 8 for x86_64
- freerdp-2.11.7-3.el8_10.x86_64.rpm
MD5: 016bfbb43ce412dcd66ef337c794c1dd
SHA-256: 48f4e09cd16346f09ec349a7c4fd65015459eb8e08a786df9bf0267587ab6575
Size: 117.59 kB - freerdp-devel-2.11.7-3.el8_10.i686.rpm
MD5: 70c3376b3975a77265240bf374692dc9
SHA-256: 35a3f64ee8487da9eabaca462a8fbcdeb1b317800ab0b9a83ff310888b6a0ae8
Size: 146.79 kB - freerdp-devel-2.11.7-3.el8_10.x86_64.rpm
MD5: 5b5a0f002d81df7f9271d60f466575a6
SHA-256: 3c395bbfb6b34bd4ccf9c2cc52ea4178f3ba932eeaf24c7d4f7a473845a69379
Size: 146.81 kB - freerdp-libs-2.11.7-3.el8_10.i686.rpm
MD5: e5e260c27edc95fb68c8bdf3bf2275a3
SHA-256: fb2fd0494bd14e8d5fd8c1898675d2ced14b62647a88b38a8d121251ae563359
Size: 875.89 kB - freerdp-libs-2.11.7-3.el8_10.x86_64.rpm
MD5: 0648b9417b0f6a60bf1ec54f0d42aa89
SHA-256: 149f19ec36f3cd683130244ffcde4910c5fbf23591f866e59dd4248007c1e644
Size: 927.41 kB - libwinpr-2.11.7-3.el8_10.i686.rpm
MD5: b9735103a3f294a85e63f830dadd9621
SHA-256: fbffa9fbcdac07c1a0d7fb4e2836f5f0dde80115481019ae1821630c8ec5799a
Size: 361.59 kB - libwinpr-2.11.7-3.el8_10.x86_64.rpm
MD5: ccdb09722f666054bb5c7fe361a6ed74
SHA-256: 951dff24407d842c9ab921ce5a69197ac645b2a0dcff348467c459ccda70bbe5
Size: 378.35 kB - libwinpr-devel-2.11.7-3.el8_10.i686.rpm
MD5: cfa95516271e2f47b34fc3bd03b4e741
SHA-256: e1e7b9dbb8d7ee7ff38628a37ad0f47d729110057226fbc3e2026be62007cd58
Size: 174.93 kB - libwinpr-devel-2.11.7-3.el8_10.x86_64.rpm
MD5: f7b96c3945f9aed72957f1bce70c2ba8
SHA-256: 354f1dd2f32fe34927fc127384ec5084452d48e84e3bb74ea63082e903776d38
Size: 174.91 kB
English