The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c702ea0fb1 advisory.

    Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041, CVE-2024-32458, CVE-2024-32459,     CVE-2024-32460, CVE-2024-32658, CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9092 advisory.

    - Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,       CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,       CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2631-1 advisory.

    - CVE-2024-22211: Fixed integer overflow in `freerdp_bitmap_planar_context_reset` that could lead to heap-     buffer overflow (bsc#1219049)
    - CVE-2024-32658: Fixed out-of-bounds read in Interleaved RLE Bitmap Codec in FreeRDP based clients     (bsc#1223353)
    - CVE-2024-32659: Fixed out-of-bounds read if `((nWidth == 0) and (nHeight == 0))` (bsc#1223346)
    - CVE-2024-32660: Fixed client crash via invalid huge allocation size (bsc#1223347)
    - CVE-2024-32661: Fixed client NULL pointer dereference (bsc#1223348)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6752-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into     connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to     crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6759-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into     connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to     crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available. (CVE-2024-32660)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9718:01 advisory.

    FreeRDP is a fork of the rdesktop project.
    Security fix(es):
    - CVE-2024-32458: fix missing input length checks
    - CVE-2024-32459: fix missing input length check
    - CVE-2024-32460: fix out-of-bound read in interleaved_decompress
    - CVE-2024-32039: fix integer overflow
    - CVE-2024-32040: fix missing check
    - CVE-2024-32041: fix integer overflow     CVE(s):
    CVE-2024-32039     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of     FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions     3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with     `/bpp:32` or `/rfx` as it is on by default).
    CVE-2024-32040     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable     to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec     (e.g. use `-nsc`).
    CVE-2024-32041     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
    CVE-2024-32458     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version     of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch     the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).
    CVE-2024-32459     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that     use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and     2.11.6 patch the issue. No known workarounds are available.
    CVE-2024-32460     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using     `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to     out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths     (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
    CVE-2024-32659     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains     a patch for the issue. No known workarounds are available.
    CVE-2024-32660     FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available.
    CVE-2024-32661     FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version     3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue.
    No known workarounds are available.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:9092 advisory.

    * freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset     (CVE-2024-22211)

    * freerdp: out-of-bounds read in ncrush_decompress (CVE-2024-32459)

    * freerdp: OutOfBound Read in interleaved_decompress (CVE-2024-32460)

    * freerdp: Integer overflow & OutOfBound Write in clear_decompress_residual_data (CVE-2024-32039)

    * freerdp: integer underflow in nsc_rle_decode (CVE-2024-32040)

    * freerdp: OutOfBound Read in zgfx_decompress_segment (CVE-2024-32041)

    * freerdp: OutOfBound Read in planar_skip_plane_rle (CVE-2024-32458)

    * freerdp: out-of-bounds read (CVE-2024-32662)

    * FreeRDP: ExtractRunLengthRegular* out of bound read (CVE-2024-32658)

    * freerdp: zgfx_decompress out of memory (CVE-2024-32660)

    * freerdp: freerdp_image_copy out of bound read (CVE-2024-32659)

    * freerdp: rdp_write_logon_info_v1 NULL access (CVE-2024-32661)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0138 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-32660:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious     server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a     patch for the issue. No known workarounds are available.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
195183	Fedora 38 : freerdp (2024-c702ea0fb1)	Nessus	Fedora Local Security Checks	2024/5/9	2026/2/24	critical
211551	Oracle Linux 9 : freerdp (ELSA-2024-9092)	Nessus	Oracle Linux Local Security Checks	2024/11/19	2026/2/24	critical
204882	SUSE SLED15: freerdp / freerdp-devel / freerdp-proxy / freerdp-server / etc (SUSE-SU-2024:2631-1)	Nessus	SuSE Local Security Checks	2024/7/31	2026/6/25	critical
193891	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : FreeRDP vulnerabilities (USN-6752-1)	Nessus	Ubuntu Local Security Checks	2024/4/25	2025/2/5	critical
194731	Ubuntu 24.04 LTS. : FreeRDP vulnerabilities (USN-6759-1)	Nessus	Ubuntu Local Security Checks	2024/4/29	2025/2/5	critical
227700	Linux Distros Unpatched Vulnerability : CVE-2024-32660	Nessus	Misc.	2025/3/5	2026/7/21	high
283198	MiracleLinux 7 : freerdp-2.1.1-5.0.3.el7.AXS7 (AXSA:2025-9718:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	critical
232864	RockyLinux 9 : freerdp (RLSA-2024:9092)	Nessus	Rocky Linux Local Security Checks	2025/3/19	2025/3/19	critical
276358	TencentOS Server 4: freerdp (TSSA-2024:0138)	Nessus	Tencent Local Security Checks	2025/11/20	2026/2/24	high

检测

插件搜索

critical

critical

critical

critical

critical

high

critical

critical

high