PT-2017-12379 · X.Org Foundation+3 · Xorg-X11-Server+3

Nathan Kidd · Publicado 2017-10-12 · Atualizado 2024-06-15 · CVE-2017-12176

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions prior to 1.19.5

Description The issue is related to missing extra length validation in the ProcEstablishConnection function, which allows a malicious X client to cause the X server to crash or possibly execute arbitrary code.

Recommendations For versions prior to 1.19.5, update to version 1.19.5 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-391

CWE-20

Identificadores relacionados

ALT-PU-2017-2438

CVE-2017-12176

DLA-1186-1

DSA-4000-1

MGASA-2017-0401

OPENSUSE-SU-2024:11525-1

SUSE-SU-2017:3025-1

SUSE-SU-2017:3047-1

SUSE-SU-2017_3025-1

SUSE-SU-2017_3047-1

USN-3456-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Xorg-X11-Server

Referências · 130

• https://ubuntu.com/security/CVE-2017-12185 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4000-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0401.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-14346 · Nota
• https://suse.com/security/cve/CVE-2008-2360 · Nota
• https://suse.com/security/cve/CVE-2017-12187.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12178 · Nota de Segurança
• https://suse.com/security/cve/CVE-2006-6103 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12180 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-12183 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2017-2438 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12179 · Aviso do Fabricante
• https://bugzilla.suse.com/1063038 · Nota
• https://suse.com/security/cve/CVE-2006-6102 · Nota
• https://suse.com/security/cve/CVE-2017-12176.html · Nota