<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for freerdp</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:4293-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-11-29T15:01:10Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-11-29T15:01:10Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-11-29T15:01:10Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for freerdp</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for freerdp fixes the following issues:
  
- CVE-2022-39318: Fixed division by zero in urbdrc (bsc#1205563).
- CVE-2022-39319: Fixed missing input buffer length check in urbdrc (bsc#1205564).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-4293,SUSE-SLE-SDK-12-SP5-2022-4293,SUSE-SLE-WE-12-SP5-2022-4293</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224293-1/</URL>
      <Description>Link for SUSE-SU-2022:4293-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-November/013150.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:4293-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205563</URL>
      <Description>SUSE Bug 1205563</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205564</URL>
      <Description>SUSE Bug 1205564</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-39318/</URL>
      <Description>SUSE CVE CVE-2022-39318 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-39319/</URL>
      <Description>SUSE CVE CVE-2022-39319 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5" CPE="cpe:/o:suse:sle-we:12:sp5">SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="freerdp-2.1.2-12.32.1">
      <FullProductName ProductID="freerdp-2.1.2-12.32.1">freerdp-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="freerdp-devel-2.1.2-12.32.1">
      <FullProductName ProductID="freerdp-devel-2.1.2-12.32.1">freerdp-devel-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="freerdp-proxy-2.1.2-12.32.1">
      <FullProductName ProductID="freerdp-proxy-2.1.2-12.32.1">freerdp-proxy-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="freerdp-server-2.1.2-12.32.1">
      <FullProductName ProductID="freerdp-server-2.1.2-12.32.1">freerdp-server-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="freerdp-wayland-2.1.2-12.32.1">
      <FullProductName ProductID="freerdp-wayland-2.1.2-12.32.1">freerdp-wayland-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libfreerdp2-2.1.2-12.32.1">
      <FullProductName ProductID="libfreerdp2-2.1.2-12.32.1">libfreerdp2-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libuwac0-0-2.1.2-12.32.1">
      <FullProductName ProductID="libuwac0-0-2.1.2-12.32.1">libuwac0-0-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwinpr2-2.1.2-12.32.1">
      <FullProductName ProductID="libwinpr2-2.1.2-12.32.1">libwinpr2-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="uwac0-0-devel-2.1.2-12.32.1">
      <FullProductName ProductID="uwac0-0-devel-2.1.2-12.32.1">uwac0-0-devel-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="winpr2-devel-2.1.2-12.32.1">
      <FullProductName ProductID="winpr2-devel-2.1.2-12.32.1">winpr2-devel-2.1.2-12.32.1</FullProductName>
    </Branch>
    <Relationship ProductReference="freerdp-devel-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel-2.1.2-12.32.1">freerdp-devel-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libfreerdp2-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2-2.1.2-12.32.1">libfreerdp2-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwinpr2-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2-2.1.2-12.32.1">libwinpr2-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="winpr2-devel-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel-2.1.2-12.32.1">winpr2-devel-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="freerdp-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-2.1.2-12.32.1">freerdp-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="freerdp-proxy-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy-2.1.2-12.32.1">freerdp-proxy-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="freerdp-server-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server-2.1.2-12.32.1">freerdp-server-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libfreerdp2-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2-2.1.2-12.32.1">libfreerdp2-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwinpr2-2.1.2-12.32.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2-2.1.2-12.32.1">libwinpr2-2.1.2-12.32.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.</Note>
    </Notes>
    <CVE>CVE-2022-39318</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2-2.1.2-12.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>4.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224293-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-39318.html</URL>
        <Description>CVE-2022-39318</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205563</URL>
        <Description>SUSE Bug 1205563</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.</Note>
    </Notes>
    <CVE>CVE-2022-39319</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:freerdp-devel-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libfreerdp2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libwinpr2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:winpr2-devel-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-proxy-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:freerdp-server-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libfreerdp2-2.1.2-12.32.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libwinpr2-2.1.2-12.32.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>6.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224293-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-39319.html</URL>
        <Description>CVE-2022-39319</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205564</URL>
        <Description>SUSE Bug 1205564</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
