The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xnest | Dec 1, 2016 | Jul 3, 2012 |
| Debian | — | Upgrade xorg-server | Jul 30, 2024 | Jul 3, 2012 |
| Freebsd | — | Upgrade xorg-server | Dec 10, 2025 | Oct 18, 2011 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server. | Oct 30, 2017 | Jul 3, 2012 |
| Oracle Solaris | — | Upgrade x11/server/xorg to version 1.10.3-0.175.0.6.0.3.1223 on Solaris 11.0 | May 29, 2017 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xorg | Oct 16, 2024 | Jul 3, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 18, 2011 |
| Suse | — | Upgrade xorg-x11-server-sdkUpgrade xorg-x11-server-dmxUpgrade xorg-x11-serverUpgrade xorg-x11-XvncUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-rdp | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xserver-xorg-core | Nov 8, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub