PT-2014-1854 · Xorg+5 · Xorg-X11-Server-Xvfb+14

Ilja Van Sprundel · Published 2014-12-09 · Updated 2025-08-29 · CVE-2014-8103

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions 1.15.0 through 1.16.x before 1.16.3 xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-debuginfo version 1.15.0 xorg-x11-server-common version 1.15.0 xorg-x11-server-devel version 1.15.0 xorg-x11-server-Xvfb version 1.15.0 xorg-x11-server-Xorg version 1.15.0

Description The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted length or index values to certain functions in the DRI3 or Present extension. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely by an attacker who has passed the authentication procedure.

Recommendations For xorg-x11-server versions 1.15.0 through 1.16.x before 1.16.3, update to version 1.16.3 or later to resolve the issue. For xorg-x11-server-Xdmx version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-Xnest version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-Xephyr version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-source version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-debuginfo version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-common version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-devel version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-Xvfb version 1.15.0, update to a newer version that contains a fix for this issue. For xorg-x11-server-Xorg version 1.15.0, update to a newer version that contains a fix for this issue. As a temporary workaround, consider disabling the affected functions in the DRI3 or Present extension until a patch is available. Restrict access to the vulnerable modules to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Fix

DoS

Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-119

CWE-190

Related Identifiers

ALT-PU-2015-1154

BDU:2015-06579

BDU:2015-06581

BDU:2015-06584

BDU:2015-06586

BDU:2015-06590

BDU:2015-06592

BDU:2015-06595

BDU:2015-06598

BDU:2015-06601

BDU:2015-06604

BDU:2015-09275

BDU:2015-09276

BDU:2015-09277

BDU:2015-09278

BDU:2015-09279

BDU:2015-09280

BDU:2015-09281

BDU:2015-09282

BDU:2015-09283

BDU:2015-09284

CESA-2014_1983

CVE-2014-8103

RHSA-2014:1983

RHSA-2014_1983

USN-2436-1

USN-2436-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Xorg-X11-Server

Xorg-X11-Server-Xdmx

Xorg-X11-Server-Xephyr

Xorg-X11-Server-Xnest

Xorg-X11-Server-Xorg

Xorg-X11-Server-Xvfb

Xorg-X11-Server-Common

Xorg-X11-Server-Debuginfo

Xorg-X11-Server-Devel

Xorg-X11-Server-Source

References · 95

• https://ubuntu.com/security/CVE-2014-8096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8093 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8091 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8103 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8093 · Security Note
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-8103 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 · Security Note
• https://bdu.fstec.ru/vul/2015-06604 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8103 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8098 · Security Note
• https://ubuntu.com/security/notices/USN-2436-1 · Vendor Advisory