From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 7A5F1158451 for ; Fri, 12 Jan 2024 11:48:10 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0D439E2AD9; Fri, 12 Jan 2024 11:47:45 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id AB42FE2ACA for ; Fri, 12 Jan 2024 11:47:20 +0000 (UTC) Received: from glsamakerdev.dev.gentoo.org (unknown [140.211.166.165]) by smtp.gentoo.org (Postfix) with ESMTP id EAA12343133 for ; Fri, 12 Jan 2024 11:47:19 +0000 (UTC) Received: from [172.18.0.3] (unknown [172.18.0.3]) by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id C077EA8199 for ; Fri, 12 Jan 2024 11:47:19 +0000 (UTC) Subject: [gentoo-announce] [ GLSA 202401-16 ] FreeRDP: Multiple Vulnerabilities Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="===============5089845802533833795==" From: glsamaker@gentoo.org To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Date: Fri, 12 Jan 2024 11:47:19 -0000 Message-ID: <170506003978.7.15766414407469567099@4a99fbfff9eb> X-Archives-Salt: d2fc3255-2c97-4780-b6c3-78179d409c17 X-Archives-Hash: 51ecf0dd12347d26779394ac046485d6 --===============5089845802533833795== Content-Type: text/plain; charset="utf-8" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202401-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: FreeRDP: Multiple Vulnerabilities Date: January 12, 2024 Bugs: #881525, #918546 ID: 202401-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in FreeRDP, the worst of which could result in code execution. Background ========== FreeRDP is a free implementation of the remote desktop protocol. Affected packages ================= Package Vulnerable Unaffected ---------------- ------------ ------------ net-misc/freerdp < 2.11.0 >= 2.11.0 Description =========== Multiple vulnerabilities have been discovered in FreeRDP. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All FreeRDP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/freerdp-2.11.0" References ========== [ 1 ] CVE-2022-39316 https://nvd.nist.gov/vuln/detail/CVE-2022-39316 [ 2 ] CVE-2022-39317 https://nvd.nist.gov/vuln/detail/CVE-2022-39317 [ 3 ] CVE-2022-39318 https://nvd.nist.gov/vuln/detail/CVE-2022-39318 [ 4 ] CVE-2022-39319 https://nvd.nist.gov/vuln/detail/CVE-2022-39319 [ 5 ] CVE-2022-39320 https://nvd.nist.gov/vuln/detail/CVE-2022-39320 [ 6 ] CVE-2022-39347 https://nvd.nist.gov/vuln/detail/CVE-2022-39347 [ 7 ] CVE-2022-41877 https://nvd.nist.gov/vuln/detail/CVE-2022-41877 [ 8 ] CVE-2023-39350 https://nvd.nist.gov/vuln/detail/CVE-2023-39350 [ 9 ] CVE-2023-39351 https://nvd.nist.gov/vuln/detail/CVE-2023-39351 [ 10 ] CVE-2023-39352 https://nvd.nist.gov/vuln/detail/CVE-2023-39352 [ 11 ] CVE-2023-39353 https://nvd.nist.gov/vuln/detail/CVE-2023-39353 [ 12 ] CVE-2023-39354 https://nvd.nist.gov/vuln/detail/CVE-2023-39354 [ 13 ] CVE-2023-39355 https://nvd.nist.gov/vuln/detail/CVE-2023-39355 [ 14 ] CVE-2023-39356 https://nvd.nist.gov/vuln/detail/CVE-2023-39356 [ 15 ] CVE-2023-40181 https://nvd.nist.gov/vuln/detail/CVE-2023-40181 [ 16 ] CVE-2023-40186 https://nvd.nist.gov/vuln/detail/CVE-2023-40186 [ 17 ] CVE-2023-40187 https://nvd.nist.gov/vuln/detail/CVE-2023-40187 [ 18 ] CVE-2023-40188 https://nvd.nist.gov/vuln/detail/CVE-2023-40188 [ 19 ] CVE-2023-40567 https://nvd.nist.gov/vuln/detail/CVE-2023-40567 [ 20 ] CVE-2023-40569 https://nvd.nist.gov/vuln/detail/CVE-2023-40569 [ 21 ] CVE-2023-40574 https://nvd.nist.gov/vuln/detail/CVE-2023-40574 [ 22 ] CVE-2023-40575 https://nvd.nist.gov/vuln/detail/CVE-2023-40575 [ 23 ] CVE-2023-40576 https://nvd.nist.gov/vuln/detail/CVE-2023-40576 [ 24 ] CVE-2023-40589 https://nvd.nist.gov/vuln/detail/CVE-2023-40589 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202401-16 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --===============5089845802533833795== Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmWhJscACgkQFMQkOaVy +9ljsBAAotwjZ603dFTqBAHkqLBc/N8zd38q8MMqnxcVveVzWaAy5624AW8N6CSR t9tzo3uiFp6v6/ISHqHik1wUwu8Q0kOQ91/Hnj0CbaCTBFtdVKcDrEH1E83UzOI3 kSDgNmWKVCTIStB6EuOS53SLdD3I8FafvGm2es75qIWmmhsnT4ZJUxhb+9fWi3nA 6FyBKEKJ32d+dkfRcBO80s88ZO8Gcf6O1gkZsRHRWbZB5PFFvob8rytrrfc0Uke3 YnKhWSkPib3XmiCuEdPCyG6rB134mb/iZk8sH8/LQHhU/VKhz7f9zP4MNh5uQJ8A hiiHm9O69JuqvIxIOCNSIsj6A+oTAFG/mgvupWsw/ePUtHG5dmeQ0P6AJ3v93oJY z3W55F39z2cNS/ykWyTJnJpEHBuKtktlmFQ3pJeEjoPTmQQM45JfQmnazrM92emv B1FL1uvDJEDlmWRuEsu8jpqt+ryBxWjjJ7+McbUaekTSignn7ELiKuZ0HzkWwmRA X30hhUikzIXJKfdWXIVsYI3thUrVsqpCeGwEjTct0NyAPalqB2+xdY+FykNpX+6a zS+9pgr18UhgMfZSiTGQABVHHgFSN06x2F3Vb1tBRVixl0GsgXiVz7mPYb4+Y8be AtRfbhFEqqueySBvWJMwYq5QnDtILvtWn70HOjSLF7zRll4kvZE= =kKQR -----END PGP SIGNATURE----- --===============5089845802533833795==--