CVE-2020-11040: 
NixOS vulnerability analysis and mitigation

CVE-2020-11040 affects FreeRDP versions less than or equal to 2.0.0. The vulnerability involves an out-of-bound data read from memory in the clear_decompress_subcode_rlex function, which is visualized on screen as color. This vulnerability was patched in FreeRDP version 2.1.0 (GitHub Advisory).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125). It has been assigned a CVSS v3.1 base score of 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L, indicating that it requires network access and high privileges to exploit, but has low impact on system availability (NVD).

When exploited, the vulnerability results in out-of-bound data being read from memory, which is then displayed on screen as color artifacts. The impact is primarily limited to potential system instability or crashes, with no direct impact on confidentiality or integrity (GitHub Advisory).

The vulnerability affects all FreeRDP clients across all platforms. To exploit the vulnerability, an attacker would need to have high privileges and network access to the target system. The vulnerability is specifically triggered through the clear_decompress_subcode_rlex function (GitHub Advisory).

The primary mitigation is to upgrade to FreeRDP version 2.1.0 or later, which contains the patch for this vulnerability. As a workaround, users can disable /gfx connection modes by avoiding arguments like /gfx or /network:auto (GitHub Advisory, OpenSUSE Advisory).