PT-2014-1852 · X.Org+5 · Xorg-X11-Server-Debuginfo+15

Ilja Van Sprundel · Published 2014-12-09 · Updated 2025-08-29 · CVE-2014-8102

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xorg-x11-server-Xdmx versions 1.15.0 xorg-x11-server-debuginfo versions 1.15.0 xorg-x11-server-Xnest versions 1.15.0 xorg-x11-server-Xephyr versions 1.15.0 xorg-x11-server-source versions 1.15.0 xorg-x11-server-Xvfb versions 1.15.0 xorg-x11-server-common versions 1.15.0 xorg-x11-server-Xvnc-source versions 1.1.1 xorg-x11-server-devel versions 1.15.0 xorg-x11-server-Xorg versions 1.15.0 X.Org Server versions prior to 1.16.3

Description The issue is related to multiple vulnerabilities in the xorg-x11-server package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely by an authenticated attacker. The SProcXFixesSelectSelectionInput function in the XFixes extension is specifically mentioned as allowing remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted length value.

Recommendations For xorg-x11-server-Xdmx version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-debuginfo version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xnest version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xephyr version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-source version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xvfb version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-common version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xvnc-source version 1.1.1, update to a version later than 1.1.1. For xorg-x11-server-devel version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xorg version 1.15.0, update to a version later than 1.15.0. For X.Org Server version prior to 1.16.3, update to version 1.16.3 or later. As a temporary workaround, consider disabling the SProcXFixesSelectSelectionInput function until a patch is available.

Fix

DoS

Buffer Overflow

NULL Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-119

CWE-476

CWE-190

Related Identifiers

ALT-PU-2014-2434

BDU:2015-06579

BDU:2015-06581

BDU:2015-06583

BDU:2015-06584

BDU:2015-06586

BDU:2015-06590

BDU:2015-06592

BDU:2015-06595

BDU:2015-06598

BDU:2015-06601

BDU:2015-06604

BDU:2015-06606

BDU:2015-09275

BDU:2015-09276

BDU:2015-09277

BDU:2015-09278

BDU:2015-09279

BDU:2015-09280

BDU:2015-09281

BDU:2015-09282

BDU:2015-09283

BDU:2015-09284

BDU:2015-09285

BDU:2015-09286

CESA-2014_1983

CVE-2014-8102

DLA-120-1

DSA-3095-1

MGASA-2014-0532

RHSA-2014:1982

RHSA-2014:1983

RHSA-2014_1982

RHSA-2014_1983

SUSE-SU-2015:0427-1

SUSE-SU-2015:1025-1

USN-2436-1

USN-2436-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

X.Org Server

Xorg-X11-Server-Xdmx

Xorg-X11-Server-Xephyr

Xorg-X11-Server-Xnest

Xorg-X11-Server-Xorg

Xorg-X11-Server-Xvfb

Xorg-X11-Server-Xvnc-Source

Xorg-X11-Server-Common

Xorg-X11-Server-Debuginfo

Xorg-X11-Server-Devel

Xorg-X11-Server-Source

References · 107

• https://ubuntu.com/security/CVE-2014-8096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8093 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8091 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8093 · Security Note
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://osv.dev/vulnerability/CVE-2014-8102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• https://bdu.fstec.ru/vul/2015-09286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 · Security Note
• https://bdu.fstec.ru/vul/2015-06604 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8103 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8098 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8102 · Security Note
• https://ubuntu.com/security/notices/USN-2436-1 · Vendor Advisory