CVE-2020-11099: 
NixOS vulnerability analysis and mitigation

CVE-2020-11099 affects FreeRDP versions before 2.1.2, where an out-of-bounds read vulnerability exists in the license_read_new_or_upgrade_license_packet function. The vulnerability was discovered by Antonio Morales from GitHub Security Lab and was disclosed in June 2020 (GitHub Advisory, MITRE).

The vulnerability occurs in the license_read_new_or_upgrade_license_packet function where a manipulated license packet can lead to out-of-bounds reads to an internal buffer. The issue arises because there is no logic that range checks wBlobLen, allowing a malicious server to send a small value (even zero). This results in an abnormally small Stream_New allocation, and subsequent Stream_Read_ calls could move the pointer beyond the array's limits (Security Lab).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. The out-of-bounds read could potentially lead to information disclosure or denial of service (NVD).

The vulnerability can be exploited remotely by a malicious server sending specially crafted license packets to FreeRDP clients. No authentication is required to exploit this vulnerability, though the attack complexity is considered low (NVD).

The vulnerability was fixed in FreeRDP version 2.1.2. Users are advised to upgrade to this version or later. The fix includes additional validation checks for the stream length before performing read operations (FreeRDP Release, GitHub Commit).

Multiple Linux distributions released security advisories and patches for this vulnerability, including Ubuntu, Fedora, and Debian. Ubuntu included this fix in their security notice USN-4481-1, while Fedora released updates for both Fedora 31 and 32 (Ubuntu Notice, Fedora Update).