PT-2014-1847 · X.Org+5 · Xorg-X11-Server-Debuginfo+15

Ilja Van Sprundel · Published 2014-12-09 · Updated 2025-08-29 · CVE-2014-8097

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-debuginfo version 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-Xvfb version 1.15.0 xorg-x11-server-debuginfo version 1.1.1 xorg-x11-server-Xvnc-source version 1.1.1 xorg-x11-server version 1.15.0 xorg-x11-server-common version 1.15.0 xorg-x11-server-Xorg version 1.15.0 xorg-x11-server-devel version 1.15.0

Description The issue affects the X.Org X Window System, allowing remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted length or index value to the (1) ProcDbeSwapBuffers or (2) SProcDbeSwapBuffers function. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation of the vulnerabilities can be carried out remotely by an attacker who has passed the authentication procedure.

Recommendations For xorg-x11-server-Xdmx version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-debuginfo version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-Xnest version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-Xephyr version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-source version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-Xvfb version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-debuginfo version 1.1.1, update to a version that contains a fix for this issue. For xorg-x11-server-Xvnc-source version 1.1.1, update to a version that contains a fix for this issue. For xorg-x11-server version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-common version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-Xorg version 1.15.0, update to a version that contains a fix for this issue. For xorg-x11-server-devel version 1.15.0, update to a version that contains a fix for this issue. As a temporary workaround, consider disabling the ProcDbeSwapBuffers and SProcDbeSwapBuffers functions until a patch is available.

Fix

DoS

Buffer Overflow

NULL Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-119

CWE-476

CWE-190

Related Identifiers

ALT-PU-2014-2434

BDU:2015-06579

BDU:2015-06581

BDU:2015-06583

BDU:2015-06584

BDU:2015-06586

BDU:2015-06590

BDU:2015-06592

BDU:2015-06595

BDU:2015-06598

BDU:2015-06601

BDU:2015-06604

BDU:2015-06606

BDU:2015-09275

BDU:2015-09276

BDU:2015-09277

BDU:2015-09278

BDU:2015-09279

BDU:2015-09280

BDU:2015-09281

BDU:2015-09282

BDU:2015-09283

BDU:2015-09284

BDU:2015-09285

BDU:2015-09286

CESA-2014_1983

CVE-2014-8097

DLA-120-1

DSA-3095-1

MGASA-2014-0532

RHSA-2014:1982

RHSA-2014:1983

RHSA-2014_1982

RHSA-2014_1983

SUSE-SU-2015:0427-1

SUSE-SU-2015:1025-1

USN-2436-1

USN-2436-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Xorg-X11-Server

Xorg-X11-Server-Xdmx

Xorg-X11-Server-Xephyr

Xorg-X11-Server-Xnest

Xorg-X11-Server-Xorg

Xorg-X11-Server-Xvfb

Xorg-X11-Server-Xvnc-Source

Xorg-X11-Server-Common

Xorg-X11-Server-Debuginfo

Xorg-X11-Server-Devel

Xorg-X11-Server-Source

References · 107

• https://ubuntu.com/security/CVE-2014-8096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 · Security Note
• https://ubuntu.com/security/notices/USN-2436-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06583 · Security Note
• https://bdu.fstec.ru/vul/2015-09281 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-8097 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06579 · Security Note
• https://bdu.fstec.ru/vul/2015-09280 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8097 · Security Note
• https://ubuntu.com/security/CVE-2014-8100 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8095 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8097 · Vendor Advisory