Subject: bug#27939: closed (Re: bug#27939: FreeRDP CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 03 Aug 2017 23:23:02 +0000

Your bug report

#27939: FreeRDP CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
27939: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=27939
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#27939: FreeRDP CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839
From: Marius Bakke <[email-masked]>
To: Leo Famulari <[email-masked]>, [email-masked]
Cc: Thomas Danckaert <[email-masked]>
Date: Fri, 04 Aug 2017 01:22:01 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Leo Famulari <[email-masked]> writes:

> The bugs corresponding to CVE-2017-2834 CVE-2017-2835 CVE-2017-2836
> CVE-2017-2837 CVE-2017-2838 CVE-2017-2839 were recently fixed in the
> FreeRDP Git repo:
>
> https://github.com/FreeRDP/FreeRDP/commit/03ab68318966c3a22935a02838daaea7b7fbe96c
>
> The most serious of these bugs allow the remote server (or any server in
> between) to execute arbitrary code on your machine.

Yikes! Thanks for the heads-up.

I went ahead and updated to the 2.0.0 rc which contain this fix in
c89091459f24dee4ba4959d65e38589efc1d8d9e.

Subject: FreeRDP CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839
From: Leo Famulari <[email-masked]>
To: [email-masked]
Cc: Thomas Danckaert <[email-masked]>
Date: Thu, 3 Aug 2017 18:05:29 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

The bugs corresponding to CVE-2017-2834 CVE-2017-2835 CVE-2017-2836
CVE-2017-2837 CVE-2017-2838 CVE-2017-2839 were recently fixed in the
FreeRDP Git repo:

https://github.com/FreeRDP/FreeRDP/commit/03ab68318966c3a22935a02838daaea7b7fbe96c

The most serious of these bugs allow the remote server (or any server in
between) to execute arbitrary code on your machine.

However, these changes do not apply cleanly to our version of FreeRDP. I
don't have to port these changes back right now.