freerdp2 - Debian Package Tracker

general

source: freerdp2 (main)
version: 2.11.7+dfsg1-4
maintainer: Debian Remote Maintainers (archive) (DMD)
uploaders: Mike Gabriel [DMD] – Bernhard Miklautz [DMD]
arch: any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2
o-o-sec: 2.3.0+dfsg1-2+deb10u4
oldstable: 2.3.0+dfsg1-2+deb11u1
old-bpo: 2.10.0+dfsg1-1~bpo11+1
stable: 2.10.0+dfsg1-1
testing: 2.11.7+dfsg1-4
unstable: 2.11.7+dfsg1-4

versioned links

2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.0+dfsg1-2+deb10u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.0+dfsg1-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.0+dfsg1-1~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.0+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.11.7+dfsg1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

freerdp2-dev
freerdp2-shadow-x11
freerdp2-wayland (4 bugs: 0, 4, 0, 0)
freerdp2-x11
libfreerdp-client2-2t64
libfreerdp-server2-2t64
libfreerdp-shadow-subsystem2-2t64
libfreerdp-shadow2-2t64
libfreerdp2-2t64
libuwac0-0t64
libuwac0-dev
libwinpr-tools2-2t64
libwinpr2-2t64
libwinpr2-dev
winpr-utils

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in an unknown time
Last run: 2024-11-23T10:28:32.000Z
Previous status: unknown

testing: fail (log)
The tests ran in an unknown time
Last run: 2024-11-30T04:09:47.000Z
Previous status: unknown

Created: 2024-10-08 Last update: 2024-12-03 17:04

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2024-02-25 Last update: 2024-12-03 17:30

Depends on packages which need a new maintainer normal

The packages that freerdp2 depends on which need a new maintainer are:

docbook-xsl (#802370)
- Build-Depends: docbook-xsl

Created: 2023-09-01 Last update: 2024-12-03 16:33

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2024-10-23 Last update: 2024-12-03 12:32

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 4d650bf63007a835e6d7abb87dbb48a020099fdb
Author: Jeremy Bícha <jeremy.bicha@canonical.com>
Date:   Fri Oct 4 16:21:48 2024 -0400

    releasing package freerdp2 version 2.11.7+dfsg1-4

commit 48be8885132774192e2a611d820cdb4ef536ac00
Author: Jeremy Bícha <jeremy.bicha@canonical.com>
Date:   Fri Oct 4 12:05:57 2024 -0400

    Replace autopkgtests with the tests used by freerdp3

Created: 2024-10-05 Last update: 2024-11-30 07:04

lintian reports 4 warnings normal

Lintian reports 4 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-10-05 Last update: 2024-10-05 18:33

11 low-priority security issues in bookworm low

There are 11 open security issues in bookworm.

11 issues left for the package maintainer to handle:

CVE-2024-22211: (needs triaging) FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.
CVE-2024-32039: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).
CVE-2024-32040: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
CVE-2024-32041: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
CVE-2024-32458: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
CVE-2024-32459: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.
CVE-2024-32460: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
CVE-2024-32658: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVE-2024-32659: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVE-2024-32660: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
CVE-2024-32661: (needs triaging) FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

You can find information about how to handle these issues in the security team's documentation.

12 issues that should be fixed with the next stable update:

CVE-2023-39350: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-39351: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-39352: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-39353: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-39354: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-39356: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-40181: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2023-40186: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2023-40188: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVE-2023-40567: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
CVE-2023-40569: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
CVE-2023-40589: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Created: 2024-01-19 Last update: 2024-10-07 07:00

debian/patches: 9 patches to forward upstream low

Among the 9 debian patches available in version 2.11.7+dfsg1-4 of the package, we noticed the following issues:

9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-10-04 Last update: 2024-10-05 10:32

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2024-03-11 Last update: 2024-03-11 02:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.6.2).

Created: 2024-04-07 Last update: 2024-10-05 08:05

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2024-10-07] freerdp2 2.11.7+dfsg1-4 MIGRATED to testing (Debian testing watch)
[2024-10-04] Accepted freerdp2 2.11.7+dfsg1-4 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-10-03] Accepted freerdp2 2.11.7+dfsg1-3 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2024-07-20] Accepted freerdp2 2.11.7+dfsg1-2 (source) into unstable (Mike Gabriel)
[2024-07-15] Accepted freerdp2 2.11.7+dfsg1-1 (source) into unstable (Mike Gabriel)
[2024-05-03] freerdp2 2.11.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2024-03-25] Accepted freerdp2 2.11.5+dfsg1-1 (source) into unstable (Mike Gabriel)
[2024-02-01] Accepted freerdp2 2.11.2+dfsg1-1.1~exp2 (source) into experimental (Lukas Märdian)
[2024-01-30] Accepted freerdp2 2.11.2+dfsg1-1.1~exp1 (source amd64) into experimental (Lukas Märdian)
[2023-11-17] Accepted freerdp2 2.3.0+dfsg1-2+deb10u4 (source) into oldoldstable (Tobias Frost)
[2023-10-07] Accepted freerdp2 2.3.0+dfsg1-2+deb10u3 (source) into oldoldstable (Tobias Frost)
[2023-10-07] freerdp2 2.11.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-10-01] Accepted freerdp2 2.11.2+dfsg1-1 (source) into unstable (Mike Gabriel)
[2023-08-12] freerdp2 2.10.0+dfsg1-1.1 MIGRATED to testing (Debian testing watch)
[2023-08-12] freerdp2 2.10.0+dfsg1-1.1 MIGRATED to testing (Debian testing watch)
[2023-08-07] Accepted freerdp2 2.10.0+dfsg1-1.1 (source) into unstable (Héctor Orón Martínez) (signed by: Hector Oron Martinez)
[2023-03-17] Accepted freerdp2 2.10.0+dfsg1-1~bpo11+1 (source) into bullseye-backports (Michael Tokarev)
[2023-03-09] freerdp2 2.10.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2023-02-26] Accepted freerdp2 2.10.0+dfsg1-1 (source) into unstable (Mike Gabriel)
[2022-12-04] Accepted freerdp2 2.9.0+dfsg1-1~bpo11+1 (source) into bullseye-backports (Michael Tokarev)
[2022-12-03] freerdp2 2.9.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-11-28] Accepted freerdp2 2.9.0+dfsg1-1 (source) into unstable (Mike Gabriel)
[2022-10-18] Accepted freerdp2 2.8.1+dfsg1-1~bpo11+1 (source) into bullseye-backports (Michael Tokarev)
[2022-10-18] freerdp2 2.8.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-10-12] Accepted freerdp2 2.8.1+dfsg1-1 (source) into unstable (Mike Gabriel)
[2022-09-27] freerdp2 2.8.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-09-21] Accepted freerdp2 2.8.0+dfsg1-1 (source) into unstable (Mike Gabriel)
[2022-06-22] Accepted freerdp2 2.7.0+dfsg1-1~bpo11+1 (source) into bullseye-backports (Michael Tokarev)
[2022-05-03] freerdp2 2.7.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-04-27] Accepted freerdp2 2.7.0+dfsg1-1 (source) into unstable (Mike Gabriel)

bugs [bug history graph]

all: 7
RC: 0
I&N: 6
M&W: 0
F&P: 1
patch: 1

links

homepage
lintian (0, 4)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.11.7+dfsg1-4
17 bugs