PT-2013-1242 · Xorg+3 · Xorg-Server+3

Pedro Ribeiro · Published 2013-10-10 · Updated 2016-11-28 · CVE-2013-4396

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xorg-server versions prior to 1.14.4 xorg-server versions prior to 1.14.3-r2

Description The issue is related to a use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module. This vulnerability can be exploited by remote authenticated users via a crafted ImageText request, potentially leading to a denial of service (daemon crash) or execution of arbitrary code. Additionally, multiple vulnerabilities in the xorg-server package may compromise the confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions prior to 1.14.4, update to version 1.14.4 or later. For versions prior to 1.14.3-r2, update to version 1.14.3-r2 or later. As a temporary workaround, consider restricting access to the xorg-server module until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09727

CESA-2013_1426

CVE-2013-4396

DSA-2784-1

MGASA-2013-0317

OPENSUSE-SU-2024:10518-1

RHSA-2013:1426

RHSA-2013_1426

SUSE-SU-2013_1728-1

SUSE-SU-2015:0427-1

SUSE-SU-2015:1025-1

Affected Products

Centos

Red Hat

Suse

Xorg-Server

References · 35

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4396 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1426.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4396 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0317 · Vendor Advisory
• http://lists.x.org/archives/xorg-announce/2013-October/002332.html · Vendor Advisory
• http://debian.org/security/2013/dsa-2784 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00060.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09727 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00056.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1014561 · Patch
• http://ubuntu.com/usn/USN-1990-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0317.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4396 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1426.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4396 · Vendor Advisory