The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-devel | Dec 1, 2016 | Jul 3, 2012 |
| Debian | — | Upgrade xorg-server | Jul 30, 2024 | Jul 3, 2012 |
| Freebsd | — | Upgrade xorg-server | Dec 10, 2025 | Oct 18, 2011 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server. | Oct 30, 2017 | Jul 3, 2012 |
| Oracle Solaris | — | Upgrade x11/server/xorg to version 1.10.3-0.175.0.6.0.3.1223 on Solaris 11.0 | May 29, 2017 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-common | Oct 16, 2024 | Jul 3, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 18, 2011 |
| Suse | — | Upgrade xorg-x11-serverUpgrade xorg-x11-server-dmxUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-rdpUpgrade xorg-x11-Xvnc | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xserver-xorg-core | Nov 8, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub