CVE-2020-11042: 
NixOS vulnerability analysis and mitigation

CVE-2020-11042 affects FreeRDP versions greater than 1.1 and before 2.0.0, discovered in early 2020. The vulnerability exists in the update_read_icon_info function of the software, impacting all FreeRDP clients (GitHub Advisory).

The vulnerability is an out-of-bounds read in the update_read_icon_info function. The issue allows reading an attacker-defined amount of client memory (32bit unsigned, up to 4GB) to an intermediate buffer. The CVSS v3.1 base score is 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability can be exploited to crash the client or store information for later retrieval, potentially leading to information disclosure and denial of service. The impact primarily affects client systems using vulnerable versions of FreeRDP (GitHub Advisory).

The vulnerability requires network access and high privileges to exploit, though it has high complexity. A malicious server can trigger the vulnerability by sending specially crafted data to a vulnerable client (Ubuntu Security).

The vulnerability has been patched in FreeRDP version 2.0.0. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu and Debian (Debian LTS, Ubuntu Advisory).