vulnerability

FreeBSD: VID-FFA15B3B-E6F6-11EA-8CBF-54E1AD3D6335 (CVE-2020-14362): xorg-server -- Multiple input validation failures in X server extensions

Severity
5
CVSS
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
Published
Aug 25, 2020
Added
Aug 26, 2020
Modified
Oct 20, 2020

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.


From VID-FFA15B3B-E6F6-11EA-8CBF-54E1AD3D6335:




The X.org project reports:



All theses issuses can lead to local privileges elevation on


systems where the X server is running privileged.


The handler for the XkbSetNames request does not validate the


request length before accessing its contents.


An integer underflow exists in the handler for the


XIChangeHierarchy request.


An integer underflow exist in the handler for the XkbSelectEvents


request.


An integer underflow exist in the handler for the CreateRegister


request of the X record extension.




Solution(s)

freebsd-upgrade-package-xephyrfreebsd-upgrade-package-xorg-dmxfreebsd-upgrade-package-xorg-nestserverfreebsd-upgrade-package-xorg-serverfreebsd-upgrade-package-xorg-vfbserverfreebsd-upgrade-package-xwayland
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.