This advisory covers a set of 12 vulnerabilities in FreeRDP affecting Red Hat Enterprise Linux 9 and its variants. The vulnerabilities include an integer overflow leading to a heap overflow (CVE-2024-22211), multiple out-of-bounds reads (CVE-2024-32459, CVE-2024-32460, CVE-2024-32458, CVE-2024-32662, CVE-2024-32658, CVE-2024-32659), integer overflow and out-of-bounds write (CVE-2024-32039), integer underflow (CVE-2024-32040), out-of-bounds read in decompression segments (CVE-2024-32041), out of memory condition (CVE-2024-32660), and a null pointer dereference (CVE-2024-32661). These vulnerabilities affect various decompression and image handling routines within FreeRDP. Red Hat has issued a security update for these issues in Red Hat Enterprise Linux 9, with the security impact rated as Moderate.

The vulnerabilities could lead to memory corruption conditions such as heap overflow, out-of-bounds reads and writes, integer overflows and underflows, and null pointer dereferences. Such conditions may cause application crashes or potentially enable attackers to execute arbitrary code or cause denial of service when processing malicious RDP data. The impact is limited to the FreeRDP client implementation used in Red Hat Enterprise Linux 9 and related products.

Red Hat has released an official security update for FreeRDP in Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as per Red Hat's guidance documented in https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.