CVE-2012-2118

xorg-x11-server: Input device name logging format string flaw

Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed

Vendors

X.org

Products

X11

CVE-2011-4613

xorg-x11-server: wrapper security bypass

The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Ubuntu and 1 more

Products

Ubuntu Linux Debian Linux Linux and 1 more

CVE-2011-4029

xorg-x11-server: lock file chmod change race condition

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux X Server

CVE-2011-4028

xorg-x11-server: File existence disclosure vulnerability

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux X Server

CVE-2010-4818

X.org: multiple GLX input sanitization flaws

The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.

CVSS 2.0 · 8.5 High EPSS 5.3% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux X.org

CVE-2013-2066

libXv: Array Index error leading to heap-based OOB write

Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function.

CVSS 2.0 · 6.8 Medium EPSS 2.3% KEV · Not listed

Vendors

Redhat X X.org

Products

Enterprise Linux Libxv Libxv

CVE-2013-1998

libXi: Multiple Array Index error leading to heap-based OOB write

Multiple buffer overflows in X.org libXi 1.7.1 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XGetDeviceButtonMapping, (2) XIPassiveGrabDevice, and (3) XQueryDeviceState functions.

CVSS 2.0 · 6.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Libxi

CVE-2013-1995

libXi: Sign extension issues resulting in heap-based buffer overflow

X.org libXi 1.7.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the XListInputDevices function.

CVSS 2.0 · 6.8 Medium EPSS 1.9% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Libxi

CVE-2022-44617

libXpm: Runaway loop on width of 0 and enormous height

A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2022-46285

libXpm: Infinite loop on unclosed comments

A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2022-4883

libXpm: compression commands depend on $PATH

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2023-0494

xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat X.org

Products

Fedora Enterprise Linux Enterprise Linux Aus and 19 more

CVE-2022-46344

xorg-x11-server: XIChangeProperty out-of-bounds access

A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2023-3138

libX11: InitExt.c can overwrite unintended portions of the Display structure if the extension request leads to a buffer overflow

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Redhat X.org

Products

Enterprise Linux Rhel Eus Libx11

CVE-2021-4011

xorg-x11-server: SwapCreateRegister out-of-bounds access

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-4010

xorg-x11-server: SProcScreenSaverSuspend out-of-bounds access

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-4009

xorg-x11-server: SProcXFixesCreatePointerBarrier out-of-bounds access

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-4008

xorg-x11-server: SProcRenderCompositeGlyphs out-of-bounds access

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-3472

xorg-x11-server: XChangeFeedbackControl integer underflow leads to privilege escalation

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-31535

libX11: missing request length checks

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.

CVSS 3.1 · 9.8 Critical EPSS 10.4% KEV · Not listed

Vendors

Fedoraproject Redhat X.org

Products

Fedora Ansible Automation Platform Enterprise Linux and 2 more