PT-2017-7394 · Canonical · Lightdm

Adam Mariš · Publicado 2015-11-27 · Atualizado 2017-09-21 · CVE-2015-8316

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LightDM versions 1.14.3, 1.16.x through 1.16.5

Description The issue is related to an array index error in LightDM when the XDMCP server is enabled, allowing remote attackers to cause a denial of service by crashing the process. This can be achieved via an XDMCP request packet with no address.

Recommendations For LightDM version 1.14.3, consider upgrading to a version later than 1.14.3. For LightDM versions 1.16.x through 1.16.5, upgrade to version 1.16.6 or later to resolve the issue. As a temporary workaround, consider disabling the XDMCP server until a patch is available.

Correção

Improper Validation of Array Index

Enumeração de Fraquezas

CWE-129

Identificadores relacionados

CVE-2015-8316

MGASA-2015-0461

Produtos afetados

Lightdm

Referências · 14

• https://osv.dev/vulnerability/MGASA-2015-0461 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8316 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/11/21/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8316 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2015-0461.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/11/22/1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8316 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8316 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-8316 · Aviso do Fabricante
• https://bugs.launchpad.net/lightdm/+bug/1516831 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1284574 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=17210 · Nota
• https://osv.dev/vulnerability/CVE-2015-8316 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8316 · Aviso do Fabricante