PT-2014-1851 · X.Org+6 · Xorg-X11-Server-Debuginfo+18

Ilja Van Sprundel · Published 2014-12-09 · Updated 2025-08-29 · CVE-2014-8101

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X.Org Server versions prior to 1.16.3 XFree86 version 4.2.0 X.Org X Window System version X11R6.7 xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-debuginfo version 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-Xvfb version 1.15.0 xorg-x11-server-debuginfo version 1.1.1 xorg-x11-server-common version 1.15.0 xorg-x11-server version 1.15.0 xorg-x11-server-Xorg version 1.15.0 xorg-x11-server-devel version 1.15.0 xorg-x11-server-Xvnc-source version 1.1.1

Description The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted length or index values to the SProcRRQueryVersion, SProcRRGetScreenInfo, SProcRRSelectInput, or SProcRRConfigureOutputProperty functions. This can lead to out-of-bounds read or write operations. The vulnerability can be exploited by a remote attacker who has passed the authentication procedure.

Recommendations For X.Org Server versions prior to 1.16.3, update to version 1.16.3 or later. For XFree86 version 4.2.0, consider upgrading to a newer version of X.Org Server. For xorg-x11-server-Xdmx version 1.15.0, xorg-x11-server-debuginfo version 1.15.0, xorg-x11-server-Xnest version 1.15.0, xorg-x11-server-Xephyr version 1.15.0, xorg-x11-server-source version 1.15.0, xorg-x11-server-Xvfb version 1.15.0, xorg-x11-server-debuginfo version 1.1.1, xorg-x11-server-common version 1.15.0, xorg-x11-server version 1.15.0, xorg-x11-server-Xorg version 1.15.0, xorg-x11-server-devel version 1.15.0, and xorg-x11-server-Xvnc-source version 1.1.1, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the vulnerable functions until a patch is available.

Fix

DoS

Buffer Overflow

NULL Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-119

CWE-476

CWE-190

Related Identifiers

ALT-PU-2014-2434

BDU:2015-06579

BDU:2015-06581

BDU:2015-06583

BDU:2015-06584

BDU:2015-06586

BDU:2015-06590

BDU:2015-06592

BDU:2015-06595

BDU:2015-06598

BDU:2015-06601

BDU:2015-06604

BDU:2015-06606

BDU:2015-09275

BDU:2015-09276

BDU:2015-09277

BDU:2015-09278

BDU:2015-09279

BDU:2015-09280

BDU:2015-09281

BDU:2015-09282

BDU:2015-09283

BDU:2015-09284

BDU:2015-09285

BDU:2015-09286

CESA-2014_1983

CVE-2014-8101

DLA-120-1

DSA-3095-1

MGASA-2014-0532

RHSA-2014:1982

RHSA-2014:1983

RHSA-2014_1982

RHSA-2014_1983

SUSE-SU-2015:0427-1

SUSE-SU-2015:1025-1

USN-2436-1

USN-2436-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

X.Org Server

X.Org X Window System

Xfree86

Xorg-X11-Server

Xorg-X11-Server-Xdmx

Xorg-X11-Server-Xephyr

Xorg-X11-Server-Xnest

Xorg-X11-Server-Xorg

Xorg-X11-Server-Xvfb

Xorg-X11-Server-Xvnc-Source

Xorg-X11-Server-Common

Xorg-X11-Server-Debuginfo

Xorg-X11-Server-Devel

Xorg-X11-Server-Source

References · 106

• https://ubuntu.com/security/CVE-2014-8096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8101 · Security Note
• https://ubuntu.com/security/notices/USN-2436-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06583 · Security Note
• https://bdu.fstec.ru/vul/2015-09281 · Security Note
• https://bdu.fstec.ru/vul/2015-06579 · Security Note
• https://bdu.fstec.ru/vul/2015-09280 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8097 · Security Note
• https://ubuntu.com/security/CVE-2014-8100 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8095 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8102 · Vendor Advisory