CLSA-2026-1789401857

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1789401857
Upstream
CVE (2)
Published
2026-09-14T16:04:31Z
Modified
2026-10-26T09:43:39Z
Summary
freerdp: Fix of 2 CVEs
Details
  • CVE-2026-67291: fix heap out-of-bounds read in update_process_glyph_fragments; reject a GLYPH_FRAGMENT_ADD update whose one-byte server-declared fragment size exceeds the bytes remaining in the received order buffer, instead of passing it straight to glyph_cache_fragment_put which copies that many bytes
  • CVE-2026-67288: fix NULL pointer dereference in the smartcard cache handlers; card_id_and_name_a now rejects NULL CardIdentifier/LookupName instead of calling strlen on them, and PCSC_SCardReadCacheA/W skip the cache lookup and initialise data, so a NULL NDR LookupName pointer in SCARD_IOCTL_READCACHEA/W can no longer crash the client
References

Affected packages

TuxCare:OracleLinux:7
freerdp

Package

Name
freerdp
Purl
pkg:rpm/tuxcare/freerdp?distro=oraclelinux-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-5.el7_9.tuxcare.els27

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json"
freerdp-devel

Package

Name
freerdp-devel
Purl
pkg:rpm/tuxcare/freerdp-devel?distro=oraclelinux-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-5.el7_9.tuxcare.els27

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json"
freerdp-libs

Package

Name
freerdp-libs
Purl
pkg:rpm/tuxcare/freerdp-libs?distro=oraclelinux-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-5.el7_9.tuxcare.els27

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json"
libwinpr

Package

Name
libwinpr
Purl
pkg:rpm/tuxcare/libwinpr?distro=oraclelinux-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-5.el7_9.tuxcare.els27

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json"
libwinpr-devel

Package

Name
libwinpr-devel
Purl
pkg:rpm/tuxcare/libwinpr-devel?distro=oraclelinux-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.1.1-5.el7_9.tuxcare.els27

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1789401857.json"