CVE-2020-11045: 
NixOS vulnerability analysis and mitigation

CVE-2020-11045 affects FreeRDP versions after 1.0 and before 2.0.0. The vulnerability was discovered in March 2020 and publicly disclosed on May 7, 2020. This security issue impacts the FreeRDP client, which is a free implementation of the Remote Desktop Protocol (RDP) (GitHub Advisory).

The vulnerability is an out-of-bounds read vulnerability in the update_read_bitmap_data function of FreeRDP. The issue occurs when processing bitmap data, where insufficient bounds checking allows client memory to be read into an image buffer. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low), with attack vector being Network, attack complexity High, and requiring High privileges (Ubuntu CVE).

When exploited, the vulnerability allows client memory to be read into an image buffer, with the result being displayed on screen as color. This could potentially lead to information disclosure from the client's memory (GitHub Advisory).

The vulnerability requires a malicious server to exploit, as it involves manipulation of bitmap data sent to the client. The attack complexity is rated as High, and it requires High privileges to execute (Ubuntu CVE).

The vulnerability was fixed in FreeRDP version 2.0.0. The fix involves adding proper bounds checking in the update_read_bitmap_data function, as implemented in commit f8890a6. Users are recommended to upgrade to version 2.0.0 or later to address this vulnerability (GitHub Commit).