CVE-2020-11046: 
NixOS vulnerability analysis and mitigation

CVE-2020-11046 affects FreeRDP versions after 1.0 and before 2.0.0. The vulnerability was discovered in March 2020 and publicly disclosed in May 2020. The issue exists in the update_read_synchronize function where a stream out-of-bounds seek could lead to a later out-of-bounds read (CVE Database, NVD).

The vulnerability stems from a stream out-of-bounds seek operation in the update_read_synchronize function. The code performs a seek operation on the stream without properly validating the stream's length, which could result in the pointer being positioned beyond the buffer's boundaries. This issue was fixed by implementing proper bounds checking using Stream_SafeSeek instead of the unchecked Stream_Seek_UINT16 operation (GitHub Commit). The vulnerability has been assigned a CVSS v3.1 base score of 2.2 (Low), with attack vector: Network, attack complexity: High, privileges required: High, user interaction: None, scope: Unchanged, confidentiality: None, integrity: None, and availability: Low (Ubuntu CVE).

The vulnerability could lead to an out-of-bounds read condition when exploited. While the direct impact is limited, it could cause the application to crash, resulting in a denial of service condition (GitHub Advisory).

The vulnerability requires network access and has high attack complexity with high privileges required for exploitation. The out-of-bounds read condition only allows an attacker to abort a session, with no data extraction possible (Ubuntu CVE).

The vulnerability was patched in FreeRDP version 2.0.0. Various Linux distributions have released security updates to address this issue, including Ubuntu 20.04 LTS (2.1.1+dfsg1-0ubuntu0.20.04.1), Ubuntu 19.10, and Ubuntu 18.04 LTS (USN-4379-1), as well as Ubuntu 16.04 ESM (1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4) (USN-4382-1).