The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2208 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)

    * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)

    * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)

    * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect     (CVE-2023-39356)

    * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface     (CVE-2023-40186)

    * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)

    * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations     (CVE-2023-40569)

    * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)

    * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)

    * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)

    * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)

    * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0135 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2022-39316:
    FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade.

    CVE-2022-39317:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a     range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no     known workarounds for this issue.

    CVE-2022-39318:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with     division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users     unable to upgrade should not use the `/usb` redirection switch.

    CVE-2022-39319:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to     read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and     all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

    CVE-2022-39320:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt     integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A     malicious server can trick a FreeRDP based client to read out of bound data and send it back to the     server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable     to upgrade should not use the `/usb` redirection switch.

    CVE-2022-39347:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP     based client to read files outside the shared directory. This issue has been addressed in version 2.9.0     and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or     `+home-drive` redirection switch.

    CVE-2022-41877:
    FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing     input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read     out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all     users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel -     command line options `/drive`, `+drives` or `+home-drive`.

    CVE-2023-39350:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with     default compilation flags). When an insufficient blockLen is provided, and proper length validation is not     performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this vulnerability.

    CVE-2023-39351:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling.  Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability.

    CVE-2023-39352:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be     triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and     `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice     this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are     advised to upgrade. There are no known workarounds for this vulnerability.

    CVE-2023-39353:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the     `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and     `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will     cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to     upgrade. There are no known workarounds for this vulnerability.

    CVE-2023-39354:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-     Of-Bounds Read occurs because it processes `context->Planes` without  checking if it contains data of     sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a     crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade.
    There are no known workarounds for this vulnerability.

    CVE-2023-39356:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a missing offset validation may lead to an Out Of Bound Read in the function     `gdi_multi_opaque_rect`. In particular there is no code to validate if the value     `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles     without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash.
    This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are     no known workarounds for this vulnerability.

    CVE-2023-40181:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the     `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the     transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and     3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

    CVE-2023-40186:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the     `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not     affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and     3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

    CVE-2023-40188:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-     Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data     of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has     been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue.

    CVE-2023-40567:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in     which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This     issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no     known workarounds for this vulnerability.

    CVE-2023-40569:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This     issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been     addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds     for this vulnerability.

    CVE-2023-40589:
    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted     input into this function can trigger the overflow which has only been shown to cause a crash. This issue     has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known     workarounds for this issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX     (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using     `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed     for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would     cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised     to upgrade. There are no known workarounds for this vulnerability. (CVE-2023-39351)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
194814	RHEL 9 : freerdp (RHSA-2024:2208)	Nessus	Red Hat Local Security Checks	2024/4/30	2025/3/14	critical
182754	Debian dla-3606 : freerdp2-dev - security update	Nessus	Debian Local Security Checks	2023/10/8	2025/1/22	critical
276130	TencentOS Server 4: freerdp (TSSA-2024:0135)	Nessus	Tencent Local Security Checks	2025/11/20	2026/2/24	critical
226281	Linux Distros Unpatched Vulnerability : CVE-2023-39351	Nessus	Misc.	2025/3/5	2026/11/7	high

検出

プラグインの検索

critical

critical

critical

high