PT-2014-1843 · X.Org+5 · Xorg-X11-Server-Debuginfo+14
Ilja Van Sprundel
·
Publicado
2014-12-09
·
Atualizado
2025-08-29
·
CVE-2014-8092
CVSS v2.0
6.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
xorg-x11-server-Xdmx versions 1.15.0
xorg-x11-server-debuginfo versions 1.15.0
xorg-x11-server-Xnest versions 1.15.0
xorg-x11-server-Xephyr versions 1.15.0
xorg-x11-server-source versions 1.15.0
xorg-x11-server-Xvfb versions 1.15.0
xorg-x11-server-debuginfo versions 1.1.1
xorg-x11-server-Xvnc-source versions 1.1.1
xorg-x11-server versions 1.15.0
xorg-x11-server-common versions 1.15.0
xorg-x11-server-devel versions 1.15.0
Description
The issue is related to multiple integer overflows in the X.Org X Window System, which can be exploited by remote authenticated users to cause a denial of service or possibly execute arbitrary code. This can be achieved through crafted requests to certain functions, including
ProcPutImage, GetHosts, RegionSizeof, and REQUEST FIXED SIZE, resulting in out-of-bounds reads or writes. The exploitation can lead to a disruption of confidentiality, integrity, and availability of protected information.Recommendations
For xorg-x11-server-Xdmx version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-debuginfo version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-Xnest version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-Xephyr version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-source version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-Xvfb version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-debuginfo version 1.1.1, update to a version prior to the fixed version.
For xorg-x11-server-Xvnc-source version 1.1.1, update to a version prior to the fixed version.
For xorg-x11-server version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-common version 1.15.0, update to a version prior to the fixed version.
For xorg-x11-server-devel version 1.15.0, update to a version prior to the fixed version.
As a temporary workaround, consider disabling the vulnerable functions until a patch is available. Restrict access to the vulnerable modules to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.
Correção
NULL Pointer Dereference
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Xorg-X11-Server
Xorg-X11-Server-Xdmx
Xorg-X11-Server-Xephyr
Xorg-X11-Server-Xnest
Xorg-X11-Server-Xvfb
Xorg-X11-Server-Xvnc-Source
Xorg-X11-Server-Common
Xorg-X11-Server-Debuginfo
Xorg-X11-Server-Devel
Xorg-X11-Server-Source