The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xorg | Dec 1, 2016 | Jul 3, 2012 |
| Debian | — | Upgrade xorg-server | Jul 30, 2024 | Jul 3, 2012 |
| Freebsd | — | Upgrade xorg-server | Dec 10, 2025 | Oct 18, 2011 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server. | Oct 30, 2017 | Jul 3, 2012 |
| Oracle Solaris | — | Upgrade x11/server/xorg to version 1.10.3-0.175.0.6.0.3.1223 on Solaris 11.0 | May 29, 2017 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-devel | Oct 16, 2024 | Jul 3, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 18, 2011 |
| Suse | — | Upgrade xorg-x11-server-extraUpgrade xorg-x11-server-dmxUpgrade xorg-x11-XvncUpgrade xorg-x11-server-sdkUpgrade xorg-x11-serverUpgrade xorg-x11-server-rdp | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xserver-xorg-core | Nov 8, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub