CVE-2020-4033

In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.

• CWE-125
• CWE-125

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing List, Third Party Advisory
• http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease Notes, Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/0a98c450c58ec150e44781c89aa6f8e7e0f571f5Patch, Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rhj-856w-82p8Mitigation, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
• https://usn.ubuntu.com/4481-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.htmlMailing List, Third Party Advisory
• http://www.freerdp.com/2020/06/22/2_1_2-releasedRelease Notes, Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/0a98c450c58ec150e44781c89aa6f8e7e0f571f5Patch, Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rhj-856w-82p8Mitigation, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
• https://usn.ubuntu.com/4481-1/Third Party Advisory

Published

Jun 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4027Affected versions of Atlassian Confluence Server and Data Ce…4.7
• CVE-2020-4028Versions before 8.9.1, Various resources in Jira responded w…5.3
• CVE-2020-4029The /rest/project-templates/1.0/createshared resource in Atl…4.3
• CVE-2020-4030In FreeRDP before version 2.1.2, there is an out of bounds r…6.5
• CVE-2020-4031In FreeRDP before version 2.1.2, there is a use-after-free i…7.5
• CVE-2020-4032In FreeRDP before version 2.1.2, there is an integer casting…4.3
• CVE-2020-4035In WatermelonDB (NPM package "@nozbe/watermelondb") before v…5.9
• CVE-2020-4037In OAuth2 Proxy from version 5.1.1 and less than version 6.0…5.4
• CVE-2020-4038GraphQL Playground (graphql-playground-html NPM package) bef…7.4
• CVE-2020-4039SUSI.AI is an intelligent Open Source personal assistant. SU…9.1
• CVE-2020-4040Bolt CMS before version 3.7.1 lacked CSRF protection in the …4.3
• CVE-2020-4041In Bolt CMS before version 3.7.1, the filename of uploaded f…6.1