CVE-2020-4031

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	< 2.1.2

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing List, Third Party Advisory
http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease Notes, Vendor Advisory
https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74gMitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
https://usn.ubuntu.com/4481-1/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing List, Third Party Advisory
http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease Notes, Vendor Advisory
https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74gMitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
https://usn.ubuntu.com/4481-1/Third Party Advisory

Timeline

Published: Jun 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40324.3In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /re CVE-2020-40336.5In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth <CVE-2020-40355.9In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Inj CVE-2020-40375.4In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated CVE-2020-40387.4GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsani CVE-2020-40399.1SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due CVE-2020-40404.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins CVE-2020-40416.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code CVE-2020-40426.8Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret i CVE-2020-40439.8phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted CVE-2020-40447.8The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp CVE-2020-40457.5SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly