Opened 7 weeks ago

Closed 6 weeks ago

#23823 closed enhancement (fixed)

FreeRDP-3.31.0

Reported by: Bruce Dubbs Owned by: SecurityAdvisory
Priority: normal Milestone: 98-Security
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New minor version.

Change History (4)

comment:1 by Bruce Dubbs, 6 weeks ago

Milestone: 13.2 → 13.1
Owner: changed from blfs-book to Bruce Dubbs
Status: new → assigned

comment:2 by Bruce Dubbs, 6 weeks ago

# 2026-08-26 Version 3.31.0

Bugfix and security release.

# CVE

## What's Changed

  • Warnings removed
  • [codec,h264] support more hardware decoders
  • [crypto] gracefully handle failed BIO/SSL creation error
  • Ntlm custom
  • Sspi tests
  • [winpr,sspi] unify NTLM memory handling
  • [codec,yuv] bound avc444v2 chroma combine to decoded frame width
  • [client,common] use configured AAD authority for sso-mib
  • [channels,rail] fix server side channel tracker
  • Session info
  • [winpr,ntlm] limit data copy to smaller entity
  • [core,message] clone notify icon state order for async update
  • [mf, mediacodec] fix h264 typo
  • Fix for #13102
  • [client,android] send clipboard format list response
  • [gdi] bound hatched brush pattern index in gdi_patblt
  • [winpr,ntlm] require 16 byte signature buffer before access
  • [client,sdl] stop drawing when update queue is empty, fixes high CPU
  • cmake: add C++ filesystem detection module
  • [winpr] add OpenBSD support for thread ID
  • winpr: fix missing FreeLibrary/GetProcAddress declarations on Cygwin
  • winpr: fix Cygwin GetModuleHandleW/TlsAlloc collisions under static linking
  • collected bug fixes
  • [core,server] parse drdynvc PDU through a substream
  • [client,common] fix audio-mode documentation
  • [client,android] replace deprecated KeyboardView
  • [urbdrc] Fix TRANSFER_OUT completion framing
  • [client,x11] abort if invalid monitor index was supplied.
  • [codec,dsp] reset buffered samples on close
  • Avc444 chroma
  • [core,nla] report early user auth denial as ACCESS_DENIED
  • [server,proxy] free peer while peer_list locked
  • Hotplug
  • uwac: don't try to use O_TMPFILE on OpenBSD
  • [winpr,string] fix building on OpenBSD
  • [channels,urbdrc] report the real IOCONTROL_COMPLETION output size
  • [codec,openh264] handle nonzero result codes
  • [codec,h264] fix offset region change detection
  • [winpr,sspi] fix server-side SPNEGO mechanism fallback
  • [cmake] build fixes for OpenBSD
  • [winpr,sysinfo] use CLOCK_MONOTONIC as a fallback
  • [channels,rdpdr] fix missing NULL check
  • [libfreerdp,crypto] add compilation opt-in TLS AEAD data limit with RFC 8446 threshold
  • [winpr,sysinfo] use sysctlbyname for OSX and iOS
  • [settings] allow null arg in freerdp_addin_argv_new
  • [client,common] url decode file paths
  • [codec,yuv] make tile size compile time configurable
  • [cache,pointer] cleanup and more logging
  • [winpr,sspi] dispatch by package index instead of a mixed-width name
  • Fix RAIL maximize normalization on Cinnamon
  • [core,gateway] bound tsg authorize tunnel response to received length
  • [channels,rdpdr] don't free() mntbuf in handle_platform_mounts_bsd()
  • [winpr,sysinfo] use sysconf _SC_NPROCESSORS_ONLN on *BSD
  • [core,nego] report why security negotiation failed
  • uwac: only use O_TMPFILE if it exists
  • [cmake] fix Sndio bits and not limit support to just OpenBSD
  • [winpr,cmake] fixes for epollshim headers / function detection
  • [channels,rdpsnd] fix sndio compile warnings
  • [warnings] remove unused functions and variables
  • [cache,glyph] clean up code, relax order checks
  • uwac: disable the SHM_ANON support on DragonFlyBSD
  • [libfreerdp] fix detection of FFmpeg
  • Cache recreate on deacviate/reactivate, stream checks
  • [channels,smartcard] prevent duplicate cleanup
  • [channel,urbdrc] check func_get_ep_desc for validity
  • [cache,pointer] reset pointer before cache free
  • [cmake,epollshim] use PkgConfig::EPOLLSHIM target
  • [client,sdl] fix scaled drawing
  • [cmake] link explicitly PUBLIC/PRIVATE/INTERFACE
  • [client,core] add gcc validity checks
  • [crypto,x509] relax object_string checks
  • [codec,av1] use dav1d for AV1 decoding
  • [scard,pack] fix NDR pointer validation for empty card handles
  • Pkg config imported
  • [utils,test] fix generated test data
  • [channels,rail] fix NULL deref race on server channel start
  • [channels,cliprdr] fix long format list parse
  • [scard,pack] remove incorrect stream length checks in unpack functions
  • [client,x11] clear errno before keyboard pipe read
  • Fix use-after-free of the printer driver singleton
  • [codec,yuv] fix pool_decode_rect loop variable reuse
  • [channels,cliprdr] fix server-side format-list negotiation bugs
  • fix use-after-free when winpr_aligned_recalloc fails
  • [channel,urbdrc] add missing check
  • [utils,rdpdr] force 64bit arithmetic in rdpdr_dump_packet
  • Sdl image clipboard
  • [codec,fdk] revert AACENC_GRANULE_LENGTH,
  • [winpr,sspi] add custom extensions
  • Sspi cleanup
  • Canonicalize paths
  • Timeout
  • Rail workarea updates
  • OSS-Fuzz: Disable SNDIO manually for oss-fuzz build
  • Dos xattr
  • Test fuzz server
  • [winpr,cmake] guard CheckSourceCompiles
  • [core] fix memory leak in TestFuzzServerSeedGen
  • [core,connection] abort after PROTOCOL_FAILED_NEGO
  • Safe zero
  • [gdi] document cache requirement for gdi_init
  • [core,server] lock dynamic channel list while parsing
  • [cmake,yuv] fix detection without pkg-config
  • [client,x11] fix /gdi:hw surface creation
  • winpr/sspi/negotiate: NULL check sub credentials accepting context
  • [utils,scard] validate ReaderState_Return on use
  • Fuzzer improvements
  • [winpr] implement inheritable handles in CreateProcess
  • Warning fixes
  • [doxygen] add missing @since version tags
  • Cross fixes
  • [winpr,path] fix mingw builds, link lowercase names
  • Relax check in window_state_order_clone
  • [core,test] ignore SIGPIPE in TestFuzzServerSeedGen
  • Fix utf-8 encoding of LS and PS in winpr_str_has_newlines
  • Cross mingw fixes
  • [build,mingw] fix missing includes
  • [build,mingw] replace C++11 constructs
  • [client,x11] fix cliprdr infinite request loop
  • [winpr] fix TestThreadCreateProcess

comment:3 by Bruce Dubbs, 6 weeks ago

Milestone: 13.1 → 98-Security
Owner: changed from Bruce Dubbs to SecurityAdvisory
Status: assigned → new

Fixed at commit ff0339d8f4. Leaving open for SA,

comment:4 by Bruce Dubbs, 6 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.0-212 has been issued.

Note: See TracTickets for help on using tickets.