=======================================================================
===
Ubuntu Security Notice USN-3845-2
May 28, 2019

freerdp vulnerabilities
=======================================================================
===

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.10
– Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in FreeRDP.

Software Description:
– freerdp: RDP client for Windows Terminal Services

Details:

USN-3845-1 fixed several vulnerabilities in FreeRDP. This update
provides the
corresponding update for Ubuntu 18.04 LTS and Ubuntu 18.10.

Original advisory details:

Eyal Itkin discovered FreeRDP incorrectly handled certain stream
encodings. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-8784, CVE-2018-8785)

Eyal Itkin discovered FreeRDP incorrectly handled bitmaps. A
malicious server
could use this issue to cause FreeRDP to crash, resulting in a denial
of
service, or possibly execute arbitrary code. (CVE-2018-8786, CVE-2018-
8787)

Eyal Itkin discovered FreeRDP incorrectly handled certain stream
encodings. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-
8788)

Eyal Itkin discovered FreeRDP incorrectly handled NTLM
authentication. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-
8789)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
libfreerdp-client1.1 1.1.0~git20140921.1.440916e+dfsg1-
15ubuntu1.18.10.1

Ubuntu 18.04 LTS:
libfreerdp-client1.1 1.1.0~git20140921.1.440916e+dfsg1-
15ubuntu1.18.04.1

In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/usn/usn-3845-2
https://usn.ubuntu.com/usn/usn-3845-1
CVE-2018-8786, CVE-2018-8787, CVE-2018-8788, CVE-2018-8789

Package Information:

https://launchpad.net/ubuntu/+source/freerdp/1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1

https://launchpad.net/ubuntu/+source/freerdp/1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1
—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEECtyyz6azUy6AZBzSkGeI6zGnN/8FAlztt+AACgkQkGeI6zGn
N/9P+g/+MC6YhZfhOGoB+zY0IBzkdp1FWn7wEu6DjAm6Ffx0EXyLvB+hgzsrYa8p
sQ8S2noJ8U17p3kL4d22n/SsoF+cGMj9oUfMJk6A4FeYtN3NAt6OPQxkZKKInPmq
yDza8F6x4n67zQAVenJi7nS0ANV24IaIAVaNGcp+d+o6wKUXw9BSQ9iYW/wUn7T8
lflYjZ0OtNEePwZGfwPDjJqYApA/UZ6yjh5QkUxVCQvVKPWZ5F8ZQhbOG27mUwaL
h0u228TDfUGLQb2MfRmCHZUUlujEE6OFA7UTsANNZF3q5Y37ffokQN9KNG81bvCk
YcCsf3VLTyuuwWSRkLbII9ppeZs2ya3s97W7+l9hhvxlkNpxHnIdvzwyEq0fBrnF
8rvqvy/OTQE4GrmM44cYWgah2LAiT/zKGn3OiFVMkwneD2aDjhnq5fYIXleg7fSH
/UDt8dklZysBUtUo6YztboLF7h2PazwM43Oy9YTktPvVRsHx3c9BlNzmezZtr0hU
wFyES6fSi2rE/nzRwrTGOWT01kh/sd1Jks0kkToIpXOLB9oPym5HlOIYHBA1NDur
Bg2p6JLa519vZWWpiRmq6bREEWRRrxwj3xiojjVuoQjnYRfvd6dWs36R57Ta6NvB
xE05GUiyHZnCtYKQoNrDoxxtxqJFVtZGfzVHGGUxHKfTU1rs62g=
=SoqO
—–END PGP SIGNATURE—–
—