vulnerability
FreeBSD: VID-FFA15B3B-E6F6-11EA-8CBF-54E1AD3D6335 (CVE-2020-14345): xorg-server -- Multiple input validation failures in X server extensions
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:L/Au:N/C:P/I:P/A:P) | Aug 25, 2020 | Aug 26, 2020 | Oct 20, 2020 |
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-FFA15B3B-E6F6-11EA-8CBF-54E1AD3D6335:
The X.org project reports:
All theses issuses can lead to local privileges elevation on
systems where the X server is running privileged.
The handler for the XkbSetNames request does not validate the
request length before accessing its contents.
An integer underflow exists in the handler for the
XIChangeHierarchy request.
An integer underflow exist in the handler for the XkbSelectEvents
request.
An integer underflow exist in the handler for the CreateRegister
request of the X record extension.
Solution(s)
References
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.