Medium
Security advisory
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-4030
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:41 UTC · Revision 1
Source evidence
In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
osv:CVE-2020-4030
Complete source record
{
"id": "8ff9c81650be8e4168967b8f0abf5d250f3db2a4da33715f1c7c6acf25919a6a",
"url": "https://osv.dev/vulnerability/CVE-2020-4030",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-4030",
"summary": "In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.",
"evidence": "osv:CVE-2020-4030",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-4030",
"aliases": [
"CVE-2020-4030",
"GHSA-fjr5-97f5-qq98"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/freerdp/freerdp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "584efae073386e8c5f6bc265b05c87d508a9bcbc"
},
{
"fixed": "05cd9ea2290d23931f615c1b004d4b2e69074e27"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.1.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "05cd9ea2290d23931f615c1b004d4b2e69074e27"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.1.1",
"2.1.0",
"2.0.0",
"2.0.0-rc4",
"2.0.0-rc3",
"2.0.0-rc2",
"2.0.0-rc1",
"2.0.0-rc0",
"2.0.0-beta1+android11",
"2.0.0-beta1+android10",
"1.2.0-beta1+android9",
"1.2.0-beta1+android7",
"1.1.0-beta+2013071101",
"1.1.0-beta1+ios4",
"1.1.0-beta1+android5",
"1.1.0-beta1+android4",
"1.1.0-beta1+ios3",
"1.1.0-beta1+ios2",
"1.1.0-beta1+android3",
"1.1.0-beta1+android2",
"1.1.0-beta1+ios1",
"1.1.0-beta1",
"1.0.1",
"1.0.0",
"1.0-beta5",
"1.0-beta4",
"1.0-beta2",
"1.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4030.json",
"vanir_signatures": [
{
"id": "CVE-2020-4030-209a8c46",
"digest": {
"threshold": 0.9,
"line_hashes": [
"184113121016333358285319372297255994103",
"267119135253721438016611594896122215985",
"326045540664966039740554085678049561611",
"162382862271231544621632017281053450303",
"259654676096212166543301571851583945653",
"337626485554865542116482426611247910336",
"302619259917172163577505698371206255325",
"248311828760329053642212232712054145034",
"48546135914116083679518732849697493544",
"65985926792399962685983872570067836026",
"37272372742467044585560923749680642436",
"6694760769256071751895870628554319729"
]
},
"source": "https://github.com/freerdp/freerdp/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27",
"target": {
"file": "winpr/libwinpr/utils/trio/trio.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-4030-cb6fa37c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322697619999516272119702043251132197404",
"166292481726618466695783537953868435563",
"306385995903346319553142905137318845949",
"71045233625049003937872421593334296454",
"40015394476233404266510138193122806599",
"95015821797310904147094367308625177872",
"14206545713134464485059259788717227585",
"326174490194127597474829009714997758872"
]
},
"source": "https://github.com/freerdp/freerdp/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27",
"target": {
"file": "winpr/libwinpr/utils/trio/triostr.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:13:49Z"
}
}
],
"modified": "2026-10-20T14:13:49.893159307Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/",
"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98",
"https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html",
"https://usn.ubuntu.com/4481-1/",
"https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-4030",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388726,
"published_at": "2020-06-22T22:15:13.087+00:00"
}