PT-2017-7394 · Canonical · Lightdm

Adam Mariš · Published 2015-11-27 · Updated 2017-09-21 · CVE-2015-8316

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LightDM versions 1.14.3, 1.16.x through 1.16.5

Description The issue is related to an array index error in LightDM when the XDMCP server is enabled, allowing remote attackers to cause a denial of service by crashing the process. This can be achieved via an XDMCP request packet with no address.

Recommendations For LightDM version 1.14.3, consider upgrading to a version later than 1.14.3. For LightDM versions 1.16.x through 1.16.5, upgrade to version 1.16.6 or later to resolve the issue. As a temporary workaround, consider disabling the XDMCP server until a patch is available.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2015-8316

MGASA-2015-0461

Affected Products

Lightdm

References · 14

• https://osv.dev/vulnerability/MGASA-2015-0461 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8316 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8316 · Security Note
• https://advisories.mageia.org/MGASA-2015-0461.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8316 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8316 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8316 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8316 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8316 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/11/21/2 · Note
• http://openwall.com/lists/oss-security/2015/11/22/1 · Note
• https://bugs.launchpad.net/lightdm/+bug/1516831 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1284574 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17210 · Note