Akallabeth

An issue exists in WinPR where the functions `winpr read png from buffer()` and `winpr convert from jpeg()` lack proper error handling for libpng and libjpeg. A malicious RDP server or a man-in-the-middle attacker can send a malformed PNG or a truncated JPEG clipboard payload, which leads to the client aborting or exiting, resulting in a denial of service.

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 3.5.1 Description: The issue is related to a null pointer dereference. Exploitation of this issue may allow a remote attacker to cause a denial of service. FreeRDP is a free implementation of the Remote Desktop Protocol. The issue is associated with a possible `NULL` access and crash. Recommendations: For versions prior to 3.5.1, update to version 3.5.1, which contains a patch for the issue. As a temporary workaround, consider restricting the use of the RDP client until a patch is applied. No other workarounds are available.

The issue is related to an out of bound read in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it, likely resulting in a crash. The vulnerability can be exploited by a remote attacker to cause a denial of service.

The issue is related to missing input length validation in the `urbdrc` channel of the FreeRDP library. A malicious server can exploit this to trick a FreeRDP-based client into reading out-of-bound data and sending it back to the server. This could allow an attacker to gain unauthorized access to protected information or cause a denial of service.

The issue is related to the implementation of the NTLM protocol in the FreeRDP RDP client, which is associated with shortcomings in the authentication procedure. This can allow a remote attacker to disclose protected information when an empty password value is provided. The vulnerability affects FreeRDP-based RDP Server implementations, but RDP clients are not affected.

The issue is related to the authentication procedure in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). Server-side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. This affects RDP server implementations using FreeRDP to authenticate against a `SAM` file, but FreeRDP-based clients are not affected.

The issue is related to out of bound writes in a connected client. A malicious server might trigger this by sending `0` width/height or out of bound rectangles to the client using GDI or SurfaceCommands for graphics updates. This results in missing bounds checks, allowing writes to unallocated memory regions.

The issue is related to a use-after-free error in the gdi SelectObject component of the FreeRDP protocol implementation. This error occurs when memory is accessed after it has been freed. Exploitation of this issue could allow a remote attacker to cause a denial of service. All FreeRDP clients using compatibility mode with the /relax-order-checks option are affected.

The issue allows an RDP server to read the client's memory. This can occur when the client connects to the RDP server with the `echo` option. The vulnerability is located in the `drdynvc process capability request` function in the `channels/drdynvc/client/drdynvc main.c` file.