PT-2018-3183 · X.Org Foundation+5 · Libx11+5

Tobias Stoeckmann · Published 2018-08-21 · Updated 2024-06-15 · CVE-2018-14598

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libX11 versions through 1.6.5

Description The issue exists due to insufficient input validation in the XListExtensions function of the libX11 library. A malicious server can send a specially crafted reply, causing a variable to be set to NULL, which will be freed later, leading to a denial of service (segmentation fault). This can allow a remote attacker to cause a denial of service.

Recommendations For libX11 versions through 1.6.5, consider restricting access to the XListExtensions function until a patch is available. As a temporary workaround, avoid using the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-2452

BDU:2019-04314

CESA-2019_2079

CVE-2018-14598

DLA-1482-1

MGASA-2018-0377

OPENSUSE-SU-2018_2567-1

OPENSUSE-SU-2018_3012-1

OPENSUSE-SU-2024:10918-1

RHSA-2019:2079

RHSA-2019_2079

SUSE-SU-2018:2934-1

SUSE-SU-2018:2955-1

SUSE-SU-2018:3102-1

SUSE-SU-2018_2934-1

SUSE-SU-2018_2955-1

SUSE-SU-2018_3102-1

USN-3758-1

USN-3758-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libx11

References · 133

• https://access.redhat.com/errata/RHSA-2019:2079 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10918-1 · Vendor Advisory
• https://usn.ubuntu.com/3758-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201811-01 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15862 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14598 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-14598 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2955-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14598 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-2079.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14598 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0377 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1482-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15861 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F · Vendor Advisory