[SECURITY] Fedora 36 Update: freerdp-2.9.0-1.fc36
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-fd6e43dec8
2022-12-16 01:41:46.850762
--------------------------------------------------------------------------------
Name : freerdp
Product : Fedora 36
Version : 2.9.0
Release : 1.fc36
URL : http://www.freerdp.com/
Summary : Free implementation of the Remote Desktop Protocol (RDP)
Description :
The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
project.
xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
machines, xrdp and VirtualBox.
--------------------------------------------------------------------------------
Update Information:
Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
CVE-2022-39320, CVE-2022-41877 and CVE-2022-39347). ---- Update to 2.8.1
(CVE-2022-39282, CVE-2022-39283).
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 30 2022 Ondrej Holy <oholy(a)redhat.com> - 2:2.9.0-1
- Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318,
CVE-2022-39319, CVE-2022-39320, CVE-2022-41877, CVE-2022-39347).
* Mon Nov 14 2022 Ondrej Holy <oholy(a)redhat.com> - 2:2.8.1-1
- Update to 2.8.1 (CVE-2022-39282, CVE-2022-39283).
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2134713 - CVE-2022-39282 freerdp: clients using `/parallel` command line
switch might read uninitialized data
https://bugzilla.redhat.com/show_bug.cgi?id=2134713
[ 2 ] Bug #2134717 - CVE-2022-39283 freerdp: clients using the `/video` command line
switch might read uninitialized data
https://bugzilla.redhat.com/show_bug.cgi?id=2134717
[ 3 ] Bug #2143642 - CVE-2022-39316 freerdp: out of bounds read in zgfx decoder
https://bugzilla.redhat.com/show_bug.cgi?id=2143642
[ 4 ] Bug #2143643 - CVE-2022-39317 freerdp: undefined behaviour in zgfx decoder
https://bugzilla.redhat.com/show_bug.cgi?id=2143643
[ 5 ] Bug #2143644 - CVE-2022-39318 freerdp: division by zero in urbdrc channel
https://bugzilla.redhat.com/show_bug.cgi?id=2143644
[ 6 ] Bug #2143645 - CVE-2022-39319 freerdp: missing length validation in urbdrc
channel
https://bugzilla.redhat.com/show_bug.cgi?id=2143645
[ 7 ] Bug #2143646 - CVE-2022-39320 freerdp: heap buffer overflow in urbdrc channel
https://bugzilla.redhat.com/show_bug.cgi?id=2143646
[ 8 ] Bug #2143647 - CVE-2022-39347 freerdp: missing path sanitation with `drive`
channel
https://bugzilla.redhat.com/show_bug.cgi?id=2143647
[ 9 ] Bug #2143648 - CVE-2022-41877 freerdp: missing input length validation in `drive`
channel
https://bugzilla.redhat.com/show_bug.cgi?id=2143648
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-fd6e43dec8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------