PT-2014-1846 · X.Org+5 · Xorg-X11-Server-Debuginfo+14

Ilja Van Sprundel · Published 2014-12-09 · Updated 2025-08-29 · CVE-2014-8096

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-debuginfo versions 1.1.1 through 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-Xvfb version 1.15.0 xorg-x11-server-common version 1.15.0 xorg-x11-server-Xorg version 1.15.0 xorg-x11-server-devel version 1.15.0 X.Org Server versions prior to 1.16.3

Description The issue affects the X.Org X Window System, allowing remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted length or index value in the SProcXCMiscGetXIDList function. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely by an attacker who has passed the authentication procedure.

Recommendations For xorg-x11-server-Xdmx version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-debuginfo versions 1.1.1 through 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xnest version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xephyr version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-source version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xvfb version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-common version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xorg version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-devel version 1.15.0, update to a version later than 1.15.0. For X.Org Server versions prior to 1.16.3, update to version 1.16.3 or later. As a temporary workaround, consider disabling the SProcXCMiscGetXIDList function until a patch is available.

Fix

DoS

Buffer Overflow

NULL Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-119

CWE-476

CWE-190

Related Identifiers

ALT-PU-2014-2434

BDU:2015-06579

BDU:2015-06581

BDU:2015-06583

BDU:2015-06584

BDU:2015-06586

BDU:2015-06590

BDU:2015-06592

BDU:2015-06595

BDU:2015-06598

BDU:2015-06601

BDU:2015-06604

BDU:2015-06606

BDU:2015-09275

BDU:2015-09276

BDU:2015-09277

BDU:2015-09278

BDU:2015-09279

BDU:2015-09280

BDU:2015-09281

BDU:2015-09282

BDU:2015-09283

BDU:2015-09284

BDU:2015-09285

BDU:2015-09286

CESA-2014_1983

CVE-2014-8096

DLA-120-1

DSA-3095-1

MGASA-2014-0532

RHSA-2014:1982

RHSA-2014:1983

RHSA-2014_1982

RHSA-2014_1983

SUSE-SU-2015:0427-1

SUSE-SU-2015:1025-1

USN-2436-1

USN-2436-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

X.Org Server

Xorg-X11-Server-Xdmx

Xorg-X11-Server-Xephyr

Xorg-X11-Server-Xnest

Xorg-X11-Server-Xorg

Xorg-X11-Server-Xvfb

Xorg-X11-Server-Common

Xorg-X11-Server-Debuginfo

Xorg-X11-Server-Devel

Xorg-X11-Server-Source

References · 107

• https://ubuntu.com/security/CVE-2014-8096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-8096 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2436-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06583 · Security Note
• https://bdu.fstec.ru/vul/2015-09281 · Security Note
• https://bdu.fstec.ru/vul/2015-06579 · Security Note
• https://bdu.fstec.ru/vul/2015-09280 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8097 · Security Note
• https://ubuntu.com/security/CVE-2014-8100 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8095 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8102 · Vendor Advisory