Vulnerability-Lookup

RHSA-2023:2851

Vulnerability from csaf_redhat - Published: 2023-05-16 08:59 - Updated: 2026-11-07 05:39

Summary

Red Hat Security Advisory: freerdp security update

Severity

Moderate

Notes

Topic: An update for freerdp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282) * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283) * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316) * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317) * freerdp: division by zero in urbdrc channel (CVE-2022-39318) * freerdp: missing length validation in urbdrc channel (CVE-2022-39319) * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320) * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347) * freerdp: missing input length validation in `drive` channel (CVE-2022-41877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-39282

A vulnerability was found in FreeRDP where clients on UNIX systems using /parallel command line switch might read uninitialized data and send it to the client's server. The vulnerability allows a remote attacker to gain access to sensitive information.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-908 - Use of Uninitialized Resource

Affected products

Fixed 65 products

Product	Version	Remediation
Unresolved product id: AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2022-39283

A vulnerability was found in FreeRDP where all clients using the /video command line switch might read uninitialized data, decode it as audio/video and display the result, leading to information disclosure.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Moderate

CVE-2022-39316

An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-39317

An out-of-bounds read vulnerability was discovered in FreeRDP due to missing a range check for input offset index in the ZGFX decoder. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it, resulting in a crash.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-39318

A division-by-zero issue was found in FreeRDP's libusb_udevice.c in the urbdrc channel. This flaw exists due to missing input validation in the urbdrc channel. A malicious server can pass specially crafted data to the client, causing a crash and denial of service.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE-369 - Divide By Zero

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-39319

An out-of-bound read vulnerability was discovered in FreeRDP due to improper input length validation in client/data_transfer.c in the urbdrc channel. A malicious server can trigger an out-of-bounds read by tricking a FreeRDP based client to read out-of-bound data and send it back to the server.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-39320

An out-of-bounds read vulnerability exists due to a boundary condition within the urbdrc channel. Attempting an integer addition on narrow types leads to the allocation of a buffer too small to hold the data written. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-39347

A directory traversal issue was discovered in FreeRDP. The vulnerability exists due to missing path canonicalization and base path check for the drive channel. A malicious server can trick a FreeRDP based client to read files outside of the shared directory. This issue allows an attacker to gain access to sensitive information.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

CVE-2022-41877

An out-of-bounds read vulnerability was discovered in FreeRDP due to improper input length validation in the drive channel. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Fixed 65 products, the same list as for CVE-2022-39282

Threats

Impact Low

References

58 references

URL	Category
https://access.redhat.com/errata/RHSA-2023:2851	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/documentation/en-us/red…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2134713	external
https://bugzilla.redhat.com/show_bug.cgi?id=2134717	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143642	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143643	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143644	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143645	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143646	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143647	external
https://bugzilla.redhat.com/show_bug.cgi?id=2143648	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2022-39282	self
https://bugzilla.redhat.com/show_bug.cgi?id=2134713	external
https://www.cve.org/CVERecord?id=CVE-2022-39282	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39282	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39283	self
https://bugzilla.redhat.com/show_bug.cgi?id=2134717	external
https://www.cve.org/CVERecord?id=CVE-2022-39283	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39283	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39316	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143642	external
https://www.cve.org/CVERecord?id=CVE-2022-39316	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39316	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39317	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143643	external
https://www.cve.org/CVERecord?id=CVE-2022-39317	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39317	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39318	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143644	external
https://www.cve.org/CVERecord?id=CVE-2022-39318	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39318	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39319	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143645	external
https://www.cve.org/CVERecord?id=CVE-2022-39319	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39319	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39320	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143646	external
https://www.cve.org/CVERecord?id=CVE-2022-39320	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39320	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-39347	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143647	external
https://www.cve.org/CVERecord?id=CVE-2022-39347	external
https://nvd.nist.gov/vuln/detail/CVE-2022-39347	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external
https://access.redhat.com/security/cve/CVE-2022-41877	self
https://bugzilla.redhat.com/show_bug.cgi?id=2143648	external
https://www.cve.org/CVERecord?id=CVE-2022-41877	external
https://nvd.nist.gov/vuln/detail/CVE-2022-41877	external
https://github.com/FreeRDP/FreeRDP/security/advis…	external

Acknowledgments

BT5

BoB 11th Team BT5

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for freerdp is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)\n\n* freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)\n\n* freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)\n\n* freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)\n\n* freerdp: division by zero in urbdrc channel (CVE-2022-39318)\n\n* freerdp: missing length validation in urbdrc channel (CVE-2022-39319)\n\n* freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)\n\n* freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)\n\n* freerdp: missing input length validation in `drive` channel (CVE-2022-41877)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:2851",
        "url": "https://access.redhat.com/errata/RHSA-2023:2851"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2134713",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134713"
      },
      {
        "category": "external",
        "summary": "2134717",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134717"
      },
      {
        "category": "external",
        "summary": "2143642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143642"
      },
      {
        "category": "external",
        "summary": "2143643",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143643"
      },
      {
        "category": "external",
        "summary": "2143644",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143644"
      },
      {
        "category": "external",
        "summary": "2143645",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143645"
      },
      {
        "category": "external",
        "summary": "2143646",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143646"
      },
      {
        "category": "external",
        "summary": "2143647",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143647"
      },
      {
        "category": "external",
        "summary": "2143648",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143648"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2851.json"
      }
    ],
    "title": "Red Hat Security Advisory: freerdp security update",
    "tracking": {
      "current_release_date": "2026-11-07T05:39:08+00:00",
      "generator": {
        "date": "2026-11-07T05:39:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2023:2851",
      "initial_release_date": "2023-05-16T08:59:13+00:00",
      "revision_history": [
        {
          "date": "2023-05-16T08:59:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-05-16T08:59:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:39:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.8.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CRB (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux CRB (v. 8)",
                  "product_id": "CRB-8.8.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-devel-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-devel-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-debugsource-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-10.el8.aarch64",
                  "product_id": "freerdp-libs-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "libwinpr-2:2.2.0-10.el8.aarch64",
                  "product_id": "libwinpr-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-10.el8.aarch64",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-10.el8.aarch64",
                  "product_id": "libwinpr-devel-2:2.2.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-10.el8?arch=aarch64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-devel-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-devel-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-10.el8.ppc64le",
                  "product_id": "freerdp-libs-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "libwinpr-2:2.2.0-10.el8.ppc64le",
                  "product_id": "libwinpr-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-10.el8.ppc64le",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-10.el8.ppc64le",
                  "product_id": "libwinpr-devel-2:2.2.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-10.el8?arch=ppc64le\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "freerdp-devel-2:2.2.0-10.el8.i686",
                  "product_id": "freerdp-devel-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-10.el8.i686",
                  "product_id": "freerdp-debugsource-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-10.el8.i686",
                  "product_id": "freerdp-debuginfo-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-10.el8.i686",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-10.el8.i686",
                  "product_id": "freerdp-libs-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "libwinpr-2:2.2.0-10.el8.i686",
                  "product_id": "libwinpr-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-10.el8.i686",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-10.el8.i686",
                  "product_id": "libwinpr-devel-2:2.2.0-10.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-10.el8?arch=i686\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-devel-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-devel-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-debugsource-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-10.el8.x86_64",
                  "product_id": "freerdp-libs-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "libwinpr-2:2.2.0-10.el8.x86_64",
                  "product_id": "libwinpr-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-10.el8.x86_64",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-10.el8.x86_64",
                  "product_id": "libwinpr-devel-2:2.2.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-10.el8?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-devel-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-devel-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-devel-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-devel@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debugsource-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-debugsource-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-debugsource-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debugsource@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-debuginfo-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-debuginfo@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs-debuginfo@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_id": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-debuginfo@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "freerdp-libs-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "freerdp-libs-2:2.2.0-10.el8.s390x",
                  "product_id": "freerdp-libs-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp-libs@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "libwinpr-2:2.2.0-10.el8.s390x",
                  "product_id": "libwinpr-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libwinpr-devel-2:2.2.0-10.el8.s390x",
                "product": {
                  "name": "libwinpr-devel-2:2.2.0-10.el8.s390x",
                  "product_id": "libwinpr-devel-2:2.2.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libwinpr-devel@2.2.0-10.el8?arch=s390x\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "freerdp-2:2.2.0-10.el8.src",
                "product": {
                  "name": "freerdp-2:2.2.0-10.el8.src",
                  "product_id": "freerdp-2:2.2.0-10.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/freerdp@2.2.0-10.el8?arch=src\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-10.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src"
        },
        "product_reference": "freerdp-2:2.2.0-10.el8.src",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-libs-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-libs-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-libs-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-libs-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "libwinpr-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686"
        },
        "product_reference": "libwinpr-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "libwinpr-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "libwinpr-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "libwinpr-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-devel-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "libwinpr-devel-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-debugsource-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-debugsource-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-devel-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-devel-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-devel-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-devel-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-devel-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-devel-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.i686",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
          "product_id": "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        },
        "product_reference": "libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
        "relates_to_product_reference": "CRB-8.8.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "BT5"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39282",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "discovery_date": "2022-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2134713"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in FreeRDP where clients on UNIX systems using /parallel command line switch might read uninitialized data and send it to the client\u0027s server. The vulnerability allows a remote attacker to gain access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: clients using `/parallel` command line switch might read uninitialized data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "FreeRDP based server implementations are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2134713",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134713"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39282"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq"
        }
      ],
      "release_date": "2022-10-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        },
        {
          "category": "workaround",
          "details": "Workaround: Do not use parallel port redirection (/parallel command line switch)",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "freerdp: clients using `/parallel` command line switch might read uninitialized data"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "BT5"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39283",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2134717"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in FreeRDP where all clients using the /video command line switch might read uninitialized data, decode it as audio/video and display the result, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: clients using the `/video` command line switch might read uninitialized data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "FreeRDP based server implementations are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2134717",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134717"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39283"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh"
        }
      ],
      "release_date": "2022-10-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        },
        {
          "category": "workaround",
          "details": "Workaround: Do not use the /video switch",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "freerdp: clients using the `/video` command line switch might read uninitialized data"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39316",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: out of bounds read in zgfx decoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39316"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: out of bounds read in zgfx decoder"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39317",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143643"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability was discovered in FreeRDP due to missing a range check for input offset index in the ZGFX decoder. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it, resulting in a crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: undefined behaviour in zgfx decoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39317"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143643",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143643"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39317",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39317"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39317",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39317"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: undefined behaviour in zgfx decoder"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39318",
      "cwe": {
        "id": "CWE-369",
        "name": "Divide By Zero"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A division-by-zero issue was found in FreeRDP\u0027s libusb_udevice.c in the urbdrc channel. This flaw exists due to missing input validation in the urbdrc channel. A malicious server can pass specially crafted data to the client, causing a crash and denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: division by zero in urbdrc channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39318"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: division by zero in urbdrc channel"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39319",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143645"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bound read vulnerability was discovered in FreeRDP due to improper input length validation in client/data_transfer.c in the urbdrc channel. A malicious server can trigger an out-of-bounds read by tricking a FreeRDP based client to read out-of-bound data and send it back to the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: missing length validation in urbdrc channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Do not use the /usb redirection switch.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39319"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143645",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143645"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39319",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39319"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39319",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39319"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: missing length validation in urbdrc channel"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39320",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143646"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability exists due to a boundary condition within the urbdrc channel. Attempting an integer addition on narrow types leads to the allocation of a buffer too small to hold the data written. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: heap buffer overflow in urbdrc channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143646",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143646"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39320"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: heap buffer overflow in urbdrc channel"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-39347",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143647"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal issue was discovered in FreeRDP. The vulnerability exists due to missing path canonicalization and base path check for the drive channel. A malicious server can trick a FreeRDP based client to read files outside of the shared directory. This issue allows an attacker to gain access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: missing path sanitation with `drive` channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-39347"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143647",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143647"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39347",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-39347"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39347",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39347"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        },
        {
          "category": "workaround",
          "details": "Users who are unable to upgrade should not use the /drive, /drives or +home-drive redirection switches.",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: missing path sanitation with `drive` channel"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Team BT5"
          ],
          "organization": "BoB 11th",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-41877",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2022-11-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2143648"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability was discovered in FreeRDP due to improper input length validation in the drive channel. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "freerdp: missing input length validation in `drive` channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
          "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
          "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
          "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-41877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2143648",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143648"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-41877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41877"
        },
        {
          "category": "external",
          "summary": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h",
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h"
        }
      ],
      "release_date": "2022-11-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-16T08:59:13+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:2851"
        },
        {
          "category": "workaround",
          "details": "Do not use the drive redirection channel - command line options /drive, +drives or +home-drive.",
          "product_ids": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.src",
            "AppStream-8.8.0.GA:freerdp-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.aarch64",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.i686",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.ppc64le",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.s390x",
            "AppStream-8.8.0.GA:libwinpr-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-debugsource-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-devel-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:freerdp-libs-debuginfo-2:2.2.0-10.el8.x86_64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.aarch64",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.i686",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.ppc64le",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.s390x",
            "CRB-8.8.0.GA:libwinpr-debuginfo-2:2.2.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "freerdp: missing input length validation in `drive` channel"
    }
  ]
}

CVE-2022-39282 (GCVE-0-2022-39282)

Vulnerability from cvelistv5 – Published: 2022-10-12 00:00 – Updated: 2025-11-03 20:34

Title

RDP client: Read of uninitialized memory with parallel port redirection

Summary

FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:56 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1
https://security.gentoo.org/glsa/202210-24	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: <= 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:34:55.910Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1"
          },
          {
            "name": "GLSA-202210-24",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-24"
          },
          {
            "name": "FEDORA-2022-d6310a1308",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/"
          },
          {
            "name": "FEDORA-2022-e733724edb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:56:33.390748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:51:31.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-17T19:06:19.355Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1"
        },
        {
          "name": "GLSA-202210-24",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-24"
        },
        {
          "name": "FEDORA-2022-d6310a1308",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/"
        },
        {
          "name": "FEDORA-2022-e733724edb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        }
      ],
      "source": {
        "advisory": "GHSA-c45q-wcpg-mxjq",
        "discovery": "UNKNOWN"
      },
      "title": "RDP client: Read of uninitialized memory with parallel port redirection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39282",
    "datePublished": "2022-10-12T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:34:55.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39283 (GCVE-0-2022-39283)

Vulnerability from cvelistv5 – Published: 2022-10-12 00:00 – Updated: 2025-11-03 20:34

Title

FreeRDP may read and display out of bounds data

Summary

FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:56 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1
https://github.com/FreeRDP/FreeRDP/security/advis…
https://security.gentoo.org/glsa/202210-24	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: <= 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:34:57.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh"
          },
          {
            "name": "GLSA-202210-24",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-24"
          },
          {
            "name": "FEDORA-2022-d6310a1308",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/"
          },
          {
            "name": "FEDORA-2022-e733724edb",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39283",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:56:30.708429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:51:26.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-17T19:06:25.835Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh"
        },
        {
          "name": "GLSA-202210-24",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-24"
        },
        {
          "name": "FEDORA-2022-d6310a1308",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/"
        },
        {
          "name": "FEDORA-2022-e733724edb",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        }
      ],
      "source": {
        "advisory": "GHSA-6cf9-3328-qrvh",
        "discovery": "UNKNOWN"
      },
      "title": "FreeRDP may read and display out of bounds data "
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39283",
    "datePublished": "2022-10-12T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:34:57.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39316 (GCVE-0-2022-39316)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:34

Title

Out of bound read in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/commit/e865c24…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:34:58.674Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:57.485Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-5w4j-mrrh-jjrm",
        "discovery": "UNKNOWN"
      },
      "title": "Out of bound read in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39316",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:34:58.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39317 (GCVE-0-2022-39317)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-04-23 16:37

Title

Out of bounds read in zgfx decoder in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:54 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.gentoo.org/glsa/202401-16	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:00:44.101Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:54:24.231479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:37:08.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:24.826Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-99cm-4gw7-c8jh",
        "discovery": "UNKNOWN"
      },
      "title": "Out of bounds read in zgfx decoder in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39317",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:37:08.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-39318 (GCVE-0-2022-39318)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:35

Title

Division by zero in urbdrc channel in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-20 - Improper Input Validation
CWE-369 - Divide By Zero

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/commit/80adde1…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:00.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-369",
              "description": "CWE-369: Divide By Zero",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:32.216Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-387j-8j96-7q35",
        "discovery": "UNKNOWN"
      },
      "title": "Division by zero in urbdrc channel in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39318",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:00.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39319 (GCVE-0-2022-39319)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:35

Title

Missing length validation in urbdrc channel in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/commit/1155582…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:02.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/11555828d2cf289b350baba5ad1f462f10b80b76"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:48.114Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/commit/11555828d2cf289b350baba5ad1f462f10b80b76"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-mvxm-wfj2-5fvh",
        "discovery": "UNKNOWN"
      },
      "title": "Missing length validation in urbdrc channel in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39319",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:02.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39320 (GCVE-0-2022-39320)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:35

Title

Heap buffer overflow in urbdrc channel

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:04.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00034.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:55.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-qfq2-82qr-7f4j",
        "discovery": "UNKNOWN"
      },
      "title": "Heap buffer overflow in urbdrc channel"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39320",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:04.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-39347 (GCVE-0-2022-39347)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:35

Title

Missing path sanitation with `drive` channel in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch.

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/commit/027424c…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:05.619Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:06:28.753Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-c5xq-8v35-pffg",
        "discovery": "UNKNOWN"
      },
      "title": "Missing path sanitation with `drive` channel in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39347",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:05.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-41877 (GCVE-0-2022-41877)

Vulnerability from cvelistv5 – Published: 2022-11-16 00:00 – Updated: 2025-11-03 20:35

Title

Missing input length validation in `drive` channel in FreeRDP

Summary

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel - command line options `/drive`, `+drives` or `+home-drive`.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-15 17:09 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…
https://github.com/FreeRDP/FreeRDP/commit/6655841…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.gentoo.org/glsa/202401-16	vendor-advisory
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
FreeRDP	FreeRDP	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:08.499Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/commit/6655841cf2a00b764f855040aecb8803cfc5eaba"
          },
          {
            "name": "FEDORA-2022-fd6e43dec8",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
          },
          {
            "name": "FEDORA-2022-076b1c9978",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
          },
          {
            "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
          },
          {
            "name": "GLSA-202401-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-16"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:09:17.318227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:13:04.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel - command line options `/drive`, `+drives` or `+home-drive`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T13:07:00.974Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h"
        },
        {
          "url": "https://github.com/FreeRDP/FreeRDP/commit/6655841cf2a00b764f855040aecb8803cfc5eaba"
        },
        {
          "name": "FEDORA-2022-fd6e43dec8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"
        },
        {
          "name": "FEDORA-2022-076b1c9978",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"
        },
        {
          "name": "[debian-lts-announce] 20231117 [SECURITY] [DLA 3654-1] freerdp2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"
        },
        {
          "name": "GLSA-202401-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-16"
        }
      ],
      "source": {
        "advisory": "GHSA-pmv3-wpw4-pw5h",
        "discovery": "UNKNOWN"
      },
      "title": "Missing input length validation in `drive` channel in FreeRDP"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41877",
    "datePublished": "2022-11-16T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:08.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023:2851

CVE-2022-39282 (GCVE-0-2022-39282)

CVE-2022-39283 (GCVE-0-2022-39283)

CVE-2022-39316 (GCVE-0-2022-39316)

CVE-2022-39317 (GCVE-0-2022-39317)

CVE-2022-39318 (GCVE-0-2022-39318)

CVE-2022-39319 (GCVE-0-2022-39319)

CVE-2022-39320 (GCVE-0-2022-39320)

CVE-2022-39347 (GCVE-0-2022-39347)

CVE-2022-41877 (GCVE-0-2022-41877)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour