CVE-2020-11041 Details
Description
In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html | CVE | Third Party Advisory |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w67c-26c4-2h9w | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html | CVE | Mailing ListThird Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html | [email protected] | Third Party Advisory |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w67c-26c4-2h9w | [email protected] | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html | [email protected] | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 2.1.0 |
CPE
Remediation
| |
| opensuse leap | 15.1 |
CPE
Remediation
| |
| debian debian linux | 10.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Oct 24, 2023 | Modified Analysis | [email protected] |
| Oct 7, 2023 | CVE Modified | [email protected] |
| Jul 1, 2022 | Modified Analysis | [email protected] |
| Jul 27, 2020 | CVE Modified | [email protected] |
| Jun 2, 2020 | Initial Analysis | [email protected] |