X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xorg-server | Aug 30, 2017 | May 13, 2013 |
| Debian | — | Upgrade xorg-server | Jul 30, 2024 | May 13, 2013 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server. | Oct 30, 2017 | May 13, 2013 |
| Oracle_linux | — | Upgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx | Oct 16, 2024 | May 13, 2013 |
| Suse | — | Upgrade xorg-x11-server-sdkUpgrade xorg-x11-server-extraUpgrade xorg-x11-serverUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-extra-debuginfoUpgrade sle-sdk-releaseUpgrade xorg-x11-Xvnc-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-Xvnc | Dec 12, 2013 | May 13, 2013 |
| Ubuntu | — | Upgrade xserver-xorg-core-lts-quantalUpgrade xserver-xorg-core | Nov 8, 2024 | May 13, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub