CVE-2013-4119

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2013/07/11/12Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/07/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/61072Third Party Advisory, VDB Entry
https://github.com/FreeRDP/FreeRDP/commit/0773bb9303d24473fe1185d85a424dfe159aff53Issue Tracking, Patch
http://www.openwall.com/lists/oss-security/2013/07/11/12Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/07/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/61072Third Party Advisory, VDB Entry
https://github.com/FreeRDP/FreeRDP/commit/0773bb9303d24473fe1185d85a424dfe159aff53Issue Tracking, Patch

Timeline

Published: Oct 3, 2016
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-41207.5Katello has a Denial of Service vulnerability in API OAuth authentication CVE-2013-41224.3Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as impleme CVE-2013-41235.0client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafte CVE-2013-41245.0Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4 CVE-2013-41255.4The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Adv CVE-2013-41274.7Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local us CVE-2013-41286.4Red Hat JBoss Enterprise Application Platform (EAP) 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote atta CVE-2013-41294.7The bridge multicast implementation in the Linux kernel through 3.10.3 does not check whether a certain timer is armed before modifying the CVE-2013-41305.0The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not p CVE-2013-41314.0The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to ca CVE-2013-41325.0KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows re CVE-2013-41337.5kde-workspace before 4.10.5 has a memory leak in plasma desktop