{"id":"CLSA-2026-1792805697","summary":"freerdp: Fix of 5 CVEs","details":"- CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation;\n  validate the MIC offset against the AUTHENTICATE_MESSAGE length\n- CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data;\n  check that the stream holds the declared plane lengths\n- CVE-2026-109244: winpr-makecert: create key and certificate files with\n  owner-only permissions and use a random export password\n- CVE-2026-109257: NSCodec encoder: free plane buffers in one place to\n  avoid a double free\n- CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when\n  unpacking LocateCardsByATR and reader states\n- CVE-2026-111377: server: abort static channel reassembly when fragments\n  exceed the declared total size","modified":"2026-10-26T09:43:31.484456019Z","published":"2026-10-24T16:44:45Z","upstream":["CVE-2023-39354","CVE-2026-109244","CVE-2026-109257","CVE-2026-109677","CVE-2026-111377","CVE-2026-111880"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792805697.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109244"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109257"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109677"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111377"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111880"}],"affected":[{"package":{"name":"freerdp","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/freerdp?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792805697.json"}},{"package":{"name":"freerdp-devel","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/freerdp-devel?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792805697.json"}},{"package":{"name":"freerdp-libs","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/freerdp-libs?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792805697.json"}},{"package":{"name":"libwinpr","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/libwinpr?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792805697.json"}},{"package":{"name":"libwinpr-devel","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/libwinpr-devel?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1792805697.json"}}],"schema_version":"1.9.0"}