In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2. References: http://www.freerdp.com/2020/06/22/2_1_2-released https://github.com/FreeRDP/FreeRDP/commit/6ade7b4cbfd71c54b3d724e8f2d6ac76a58e879a https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-977w-866x-4v5h
Created freerdp tracking bugs for this issue: Affects: epel-all [bug 1854901] Affects: fedora-all [bug 1854900]
Technical Summary: In the freerdp CLIENT, license_read_new_or_upgrade_license_packet() in libfreerdp/core/license.c reads from the licenseStream buffer multiple times without first ensuring that there are enough bytes left in the buffer. Thus, it's possible for the routine to read past the end of the licenseStream buffer by at most 20 bytes + cbCompanyName. The upstream patch uses Stream_GetRemainingLength() to prevent this. The license stream data is obtained from the server, thus exploitation of this flaw would require the client to connect to a malicious or compromised server.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1849 https://access.redhat.com/errata/RHSA-2021:1849
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11099