vulnerability
Oracle Linux: CVE-2018-14598: ELSA-2019-2079: Xorg security and bug fix update (MODERATE) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:H/Au:N/C:N/I:N/A:C) | Aug 21, 2018 | Jul 21, 2020 | Jan 7, 2025 |
Severity
5
CVSS
(AV:N/AC:H/Au:N/C:N/I:N/A:C)
Published
Aug 21, 2018
Added
Jul 21, 2020
Modified
Jan 7, 2025
Description
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.
It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.
Solutions
oracle-linux-upgrade-gdmoracle-linux-upgrade-gdm-develoracle-linux-upgrade-gdm-pam-extensions-develoracle-linux-upgrade-libx11oracle-linux-upgrade-libx11-commonoracle-linux-upgrade-libx11-develoracle-linux-upgrade-libxkbcommonoracle-linux-upgrade-libxkbcommon-develoracle-linux-upgrade-libxkbcommon-x11oracle-linux-upgrade-libxkbcommon-x11-develoracle-linux-upgrade-mesa-libglworacle-linux-upgrade-mesa-libglw-develoracle-linux-upgrade-xorg-x11-drv-atioracle-linux-upgrade-xorg-x11-drv-vesaoracle-linux-upgrade-xorg-x11-drv-wacomoracle-linux-upgrade-xorg-x11-drv-wacom-develoracle-linux-upgrade-xorg-x11-server-commonoracle-linux-upgrade-xorg-x11-server-develoracle-linux-upgrade-xorg-x11-server-sourceoracle-linux-upgrade-xorg-x11-server-xdmxoracle-linux-upgrade-xorg-x11-server-xephyroracle-linux-upgrade-xorg-x11-server-xnestoracle-linux-upgrade-xorg-x11-server-xorgoracle-linux-upgrade-xorg-x11-server-xvfboracle-linux-upgrade-xorg-x11-server-xwayland
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.