CVE-2021-41159

Publication date 21 October 2021

Last updated 18 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.8 · Medium

Score breakdown

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a gateway.

Status

Package Ubuntu Release Status
freerdp2 25.04 plucky
Fixed 2.3.0+dfsg1-2ubuntu2
24.10 oracular
Fixed 2.3.0+dfsg1-2ubuntu2
24.04 LTS noble
Fixed 2.3.0+dfsg1-2ubuntu2
23.10 mantic
Fixed 2.3.0+dfsg1-2ubuntu2
23.04 lunar
Fixed 2.3.0+dfsg1-2ubuntu2
22.10 kinetic
Fixed 2.3.0+dfsg1-2ubuntu2
22.04 LTS jammy
Fixed 2.3.0+dfsg1-2ubuntu2
21.10 impish
Fixed 2.3.0+dfsg1-2ubuntu0.1
21.04 hirsute
Fixed 2.3.0+dfsg1-1ubuntu0.1
20.04 LTS focal
Fixed 2.2.0+dfsg1-0ubuntu0.20.04.2
18.04 LTS bionic
Fixed 2.2.0+dfsg1-0ubuntu0.18.04.2
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Ignored end of standard support
freerdp 18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty Ignored end of standard support

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
freerdp2

Severity score breakdown

Parameter Value
Base score 5.8 · Medium
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Scope Changed
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-5154-1
    • FreeRDP vulnerabilities
    • 23 November 2021

Other references