-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 25 Feb 2026 17:24:26 +0300
Source: freerdp3
Architecture: source
Version: 3.23.0+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Remote Maintainers <debian-remote@lists.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Changes:
freerdp3 (3.23.0+dfsg-1) unstable; urgency=medium
.
* new upstream release, with enhancements and more security fixes:
CVE-2026-25941 Out-of-bounds read in rdpgfx_recv_wire_to_surface_2_pdu
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8
CVE-2026-25942 Global-buffer-overflow in xf_rail_server_execute_result
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6
CVE-2026-25952 Heap-use-after-free in xf_SetWindowMinMaxInfo
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
CVE-2026-25953 Heap-use-after-free in xf_AppUpdateWindowFromSurface
(freed appWindow)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6rq-rxpc-rh3p
CVE-2026-25954 Heap-use-after-free in xf_rail_server_local_move_size
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j
CVE-2026-25955 Heap-use-after-free in xf_AppUpdateWindowFromSurface
(stale XImage)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x
CVE-2026-25959 Heap-use-after-free in xf_cliprdr_provide_data_
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c
CVE-2026-25997 Heap-use-after-free in xf_clipboard_format_equal
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5j3-m6jf-3jq4
CVE-2026-26271 Buffer Overread in FreeRDP Icon Processing
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hr4m-ph4g-48j6
(note: there's apparently some issue linking the CVE# to this advisory)
CVE-2026-26986 Heap-use-after-free in rail_window_free
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47
CVE-2026-27015 Smartcard NDR Alignment Padding Triggers Reachable
WINPR_ASSERT Abort (Client DoS)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725
CVE-2026-26955 Heap Out-of-Bounds Write in ClearCodec Surface Command
Handler via Missing Bounds Validation
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj
CVE-2026-26965 Heap Out-of-Bounds Write in Planar Bitmap RLE Decompression
via Destination Offset
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h
* libwinpr3-3.symbols, libfreerdp3-3.symbols,
libfreerdp-server-proxy3-3.symbols: add newly appeared symbols
* libfreerdp-shadow3-3.symbols: remove rdtk_* symbols.
rdtk is now optional and defaults-off because it is unmaintained.
It weren't used much anyway. In debian, this library has no reverse
dependencies outide of freerdp3. So let's just drop these symbols for now,
and if a problem occurs, we can fix it later
Checksums-Sha1:
58452ba06e4d0a5f394648a47cd4cc0e827e3659 4640 freerdp3_3.23.0+dfsg-1.dsc
b732d66c78c2d83496847f577a0714e22fc55c8b 5114676 freerdp3_3.23.0+dfsg.orig.tar.xz
18c1cb1fc2a0315cbbb940131e865a717307eb94 53212 freerdp3_3.23.0+dfsg-1.debian.tar.xz
701570072d3abd0af30ce87e28595686ec51a199 6063 freerdp3_3.23.0+dfsg-1_source.buildinfo
Checksums-Sha256:
810454220fcf5bb3d1e5c64b76235d2679fa31003ffacf582cc59d5daef18c65 4640 freerdp3_3.23.0+dfsg-1.dsc
9d325cbb16a3a03cec3876a1385078d62a832aaec479e34fcafd66b9bc1401f6 5114676 freerdp3_3.23.0+dfsg.orig.tar.xz
ce8267f1a984c889ef300f10977854a5d1b37a5b9979fb2cecccdb950e5d80ba 53212 freerdp3_3.23.0+dfsg-1.debian.tar.xz
e149ae100dfaa5d108892c106768a3adb5d8f0e29727aac756b91c1a8fbdcc7b 6063 freerdp3_3.23.0+dfsg-1_source.buildinfo
Files:
b602259be09e48e83fd4e6c4d2126202 4640 x11 optional freerdp3_3.23.0+dfsg-1.dsc
532acf068e7971ebad9c0c0788459235 5114676 x11 optional freerdp3_3.23.0+dfsg.orig.tar.xz
9b9d36b7c3ce4d9737ef6dafd01de66a 53212 x11 optional freerdp3_3.23.0+dfsg-1.debian.tar.xz
263e8487f61227c224f7ffc010ed5a99 6063 x11 optional freerdp3_3.23.0+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJpnwY+CRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfDKk8pbcinrvczfOOXtekDh6LkZe8bREU9vmH6+/3R
MxYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AAA+yA//VMyXVF3WJvN4qWtqYhjRGGyU
/ncshTikhf2ChVup9ATSRa+UVYVhlIWJklu+9W4jsGcARIL+RWI1qPzqWc6QlcJH
TPf1nBVN2+qF/7i405R/mtr3JoHxLxxSq9a+GWt4FqMf9D3ip+71i79QSMyQiWiE
/xbPXssWnwpCIqkMJZK9tIotlaCYPyaSb6Vk98a4aqXfBEpDG68SHK3T933DKWqI
4ZdTEO5U23F3AYWq/Sg+SUBy4FGq77BWor4y2VDEuagFBcBRd2zj+jlYGg05YnaV
vgg8+9+woTwLdHW3bgg83kmnmd3iXvArjeT57iEjqq1j9feG2ktpky/qtX46GuwO
tATng7tnsQ2ux7zQXWO3T2tVYS4/hA4ySJ3ctaLWACRR94Xqn5cSQjRHVTXKpu0L
7EM1S+iSaLvYGFplH2wS8BM0mWWEg1JPmPCbA984Q4HO9DaqsWTR9tIVUGf37764
K7cTI+ous3rha9XP85wcmv2I/7bVPFSpz2rocmTT12KVZYnM2SuUmOavICz+dN3i
TjrpwiIp9IfYph6Y7oG51FO1G3AJBGWqi5T9diNeCnbv6zgLG9wfgn9duEiDkj7x
7wK+kWDcpxv8OeUuqAKE4ryVQrkK/tDLB3PrS9Mc7gzY3+3zLKUJj+3s1Rx4ae1C
R2O0RiZt2cm7mR4Jqvg=
=H3Z8
-----END PGP SIGNATURE-----
