The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xorg | Dec 1, 2016 | Jul 3, 2012 |
| Debian | — | Upgrade xorg-server | Jul 30, 2024 | Jul 3, 2012 |
| Freebsd | — | Upgrade xorg-server | Dec 10, 2025 | Oct 18, 2011 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server. | Oct 30, 2017 | Jul 3, 2012 |
| Oracle Solaris | — | Upgrade x11/server/xorg to version 1.10.3-0.175.0.6.0.3.1223 on Solaris 11.0 | May 29, 2017 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xephyr | Oct 16, 2024 | Jul 3, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 18, 2011 |
| Suse | — | Upgrade xorg-x11-server-dmxUpgrade xorg-x11-server-sdkUpgrade xorg-x11-serverUpgrade xorg-x11-XvncUpgrade xorg-x11-server-rdpUpgrade xorg-x11-server-extra | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xserver-xorg-core | Nov 8, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub