diff --git a/freerdp-2.11.6-CVE-2026-55191.patch b/freerdp-2.11.6-CVE-2026-55191.patch new file mode 100644 index 0000000000000000000000000000000000000000..e298cc2ecd886b55723f7b7342641802148c8416 --- /dev/null +++ b/freerdp-2.11.6-CVE-2026-55191.patch @@ -0,0 +1,43 @@ +From 97f40b9e766af375f4e41ac6a3f4397d708d249c Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:10:58 +0200 +Subject: [PATCH] [codec,h264] fix buffer bounds checks + +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + libfreerdp/codec/h264.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) +diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c +index 3f1ddb3..1df3894 100644 +--- a/libfreerdp/codec/h264.c ++++ b/libfreerdp/codec/h264.c +@@ -299,12 +299,27 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight) + if (pad != 0) + padDstHeight += 16 - pad; + +- if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != piMainStride[0] * padDstHeight)) ++ if ((piMainStride[0] == 0) || (padDstHeight == 0)) ++ return FALSE; ++ ++ const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight; ++ if (dstsize > UINT32_MAX) ++ return FALSE; ++ ++ if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize)) + { + for (x = 0; x < 3; x++) + { + piDstStride[x] = piMainStride[0]; +- piDstSize[x] = piDstStride[x] * padDstHeight; ++ ++ const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight; ++ if (dstride > UINT32_MAX) ++ return FALSE; ++ ++ piDstSize[x] = (UINT32)dstride; ++ if (piDstSize[x] == 0) ++ return FALSE; ++ + _aligned_free(ppYUVDstData[x]); + ppYUVDstData[x] = _aligned_malloc(piDstSize[x], 16); + diff --git a/freerdp-2.11.6-CVE-2026-55193.patch b/freerdp-2.11.6-CVE-2026-55193.patch new file mode 100644 index 0000000000000000000000000000000000000000..9dcd4be8b9e608f88a9dda724504d4bfdfbdf6d7 --- /dev/null +++ b/freerdp-2.11.6-CVE-2026-55193.patch @@ -0,0 +1,30 @@ +From a863ef1cf1cdabf9019280e5658f806e73bb50e8 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:31:09 +0200 +Subject: [PATCH] [core,gateway] rpc header max fragment size checks + +--- + libfreerdp/core/gateway/rpc_bind.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) +diff --git a/libfreerdp/core/gateway/rpc_bind.c b/libfreerdp/core/gateway/rpc_bind.c +index bdf54d5..e4d78b0 100644 +--- a/libfreerdp/core/gateway/rpc_bind.c ++++ b/libfreerdp/core/gateway/rpc_bind.c +@@ -335,6 +335,17 @@ BOOL rpc_recv_bind_ack_pdu(rdpRpc* rpc, wStream* s) + + WLog_DBG(TAG, "Receiving BindAck PDU"); + ++ const UINT16 MAX_VALID_FRAG = 0x0FF8; ++ if ((header.bind_ack.max_xmit_frag > MAX_VALID_FRAG) || ++ (header.bind_ack.max_recv_frag > MAX_VALID_FRAG)) ++ { ++ WLog_ERR(TAG, ++ "bind_ack: invalid fragment size: max_xmit_frag=%" PRIu16 ++ ", max_recv_frag=%" PRIu16 ", maximum=%" PRIu16, ++ header.bind_ack.max_xmit_frag, header.bind_ack.max_recv_frag, MAX_VALID_FRAG); ++ goto fail; ++ } ++ + rpc->max_recv_frag = header.bind_ack.max_xmit_frag; + rpc->max_xmit_frag = header.bind_ack.max_recv_frag; + diff --git a/freerdp-2.11.6-CVE-2026-55194.patch b/freerdp-2.11.6-CVE-2026-55194.patch new file mode 100644 index 0000000000000000000000000000000000000000..bec3db88dc3d9a870ca3929ede1b58887016fae1 --- /dev/null +++ b/freerdp-2.11.6-CVE-2026-55194.patch @@ -0,0 +1,23 @@ +From 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:22:26 +0200 +Subject: [PATCH] [core,gateway] ensure buffer size for current write + +--- + libfreerdp/core/gateway/rpc_client.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) + +diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c +index 1ef0c04..f96ea65 100644 +--- a/libfreerdp/core/gateway/rpc_client.c ++++ b/libfreerdp/core/gateway/rpc_client.c +@@ -400,7 +400,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment) + { + const rpcconn_response_hdr_t* response = + (const rpcconn_response_hdr_t*)&header.response; +- if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint)) ++ if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength)) + goto fail; + + if (Stream_Length(fragment) < StubOffset + StubLength) diff --git a/freerdp.spec b/freerdp.spec index dba4c60a9d04bd780b140ebccb0cff177e5d7dba..3fab73d42b2f8af0aff371d3cfeaabefd117526d 100644 --- a/freerdp.spec +++ b/freerdp.spec @@ -17,7 +17,7 @@ Summary: Free implementation of the Remote Desktop Protocol (RDP) Name: freerdp Version: 2.11.6 -Release: 17%{?dist} +Release: 18%{?dist} License: ASL 2.0 URL: http://www.freerdp.com/ Source0: https://github.com/FreeRDP/FreeRDP/archive/%{version}/%{name}-%{version}.tar.gz @@ -50,6 +50,9 @@ Patch0026: freerdp-2.11.6-CVE-2026-33984.patch Patch0027: freerdp-2.11.6-CVE-2026-33986.patch Patch0028: freerdp-2.11.6-CVE-2026-55827.patch Patch0029: freerdp-2.11.6-CVE-2026-64624.patch +Patch0030: freerdp-2.11.6-CVE-2026-55193.patch +Patch0031: freerdp-2.11.6-CVE-2026-55191.patch +Patch0032: freerdp-2.11.6-CVE-2026-55194.patch BuildRequires: gcc gcc-c++ alsa-lib-devel cmake cups-devel gsm-devel lame-devel libicu-devel libjpeg-turbo-devel BuildRequires: libX11-devel libXcursor-devel libXdamage-devel libXext-devel libXi-devel libXinerama-devel @@ -249,6 +252,10 @@ find %{buildroot} -name "*.a" -delete %{_libdir}/pkgconfig/winpr-tools2.pc %changelog +* Tue Aug 25 2026 PkgAgent Robot - 2.11.6-18 +- [Type] security +- [DESC] Fix CVE-2026-55193 (TS Gateway rpc max fragment size checks), CVE-2026-55191 (h264 avc444 buffer bounds checks), CVE-2026-55194 (RPC response reassembly uses StubLength not alloc_hint) + * Mon Jul 27 2026 Xinlong Chen - 2.11.6-17 - [Type] security - [DESC] Fix CVE-2026-64624: disable embedded CLI parsing in RDP files by default