CVE-2019-17177

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.htmlThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29aPatch, Vendor Advisory
https://github.com/FreeRDP/FreeRDP/issues/5645Third Party Advisory
https://security.gentoo.org/glsa/202005-07Third Party Advisory
https://usn.ubuntu.com/4379-1/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.htmlThird Party Advisory
https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29aPatch, Vendor Advisory
https://github.com/FreeRDP/FreeRDP/issues/5645Third Party Advisory
https://security.gentoo.org/glsa/202005-07Third Party Advisory
https://usn.ubuntu.com/4379-1/Third Party Advisory

Timeline

Published: Oct 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-171787.5HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory lea CVE-2019-171796.14.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0 CVE-2019-17187.5A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to trigger high CVE-2019-171807.8Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modificati CVE-2019-171819.8A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that CVE-2019-171837.5Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists.CVE-2019-171849.8Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker CVE-2019-171857.5In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple thr CVE-2019-171868.8/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.CVE-2019-171877.5/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for re CVE-2019-171887.2An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass CVE-2019-171895.4totemodata 3.0.0_b936 has XSS via a folder name.