ALAS2023-2026-1549

Amazon Linux 2023 Security Advisory: ALAS2023-2026-1549
Advisory Released Date: 2026-04-13
Advisory Updated Date: 2026-04-13
Severity: Important
Issue Overview:

DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93 (CVE-2026-33952)

DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5 (CVE-2026-33977)

Persistent Cache Allocator Mismatch - Heap OOB Read

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2 (CVE-2026-33982)

Progressive Codec Quant BYTE Underflow - UB + CPU DoS

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478 (CVE-2026-33983)

ClearCodec resize_vbar_entry() Heap OOB Write

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6 (CVE-2026-33984)

ClearCodec Glyph Cache Count Desync - Heap OOB Read

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85 (CVE-2026-33985)

H.264 YUV Buffer Dimension Desync - Heap OOB Write

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97 (CVE-2026-33986)

Persistent Cache bmpSize Desync - Heap OOB Write

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc (CVE-2026-33987)

double free in kerberos_AcceptSecurityContext and kerberos_IntitalizeSecurityContextA

NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx (CVE-2026-33995)


Affected Packages:

freerdp


Issue Correction:
Run dnf update freerdp --releasever 2023.11.20260413 or dnf update --advisory ALAS2023-2026-1549 --releasever 2023.11.20260413 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:
aarch64:
    freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-debuginfo-3.6.3-1.amzn2023.0.10.aarch64
    libwinpr-debuginfo-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-server-debuginfo-3.6.3-1.amzn2023.0.10.aarch64
    libwinpr-devel-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-server-3.6.3-1.amzn2023.0.10.aarch64
    libwinpr-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-libs-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-devel-3.6.3-1.amzn2023.0.10.aarch64
    freerdp-debugsource-3.6.3-1.amzn2023.0.10.aarch64

src:
    freerdp-3.6.3-1.amzn2023.0.10.src

x86_64:
    freerdp-server-debuginfo-3.6.3-1.amzn2023.0.10.x86_64
    libwinpr-3.6.3-1.amzn2023.0.10.x86_64
    libwinpr-devel-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-server-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.10.x86_64
    libwinpr-debuginfo-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-debuginfo-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-libs-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-devel-3.6.3-1.amzn2023.0.10.x86_64
    freerdp-debugsource-3.6.3-1.amzn2023.0.10.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-33952, CVE-2026-33977, CVE-2026-33982, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985, CVE-2026-33986, CVE-2026-33987, CVE-2026-33995

Mitre: CVE-2026-33952, CVE-2026-33977, CVE-2026-33982, CVE-2026-33983, CVE-2026-33984, CVE-2026-33985, CVE-2026-33986, CVE-2026-33987, CVE-2026-33995