CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-14363 – libX11: integer overflow leads to double free in locale handling
https://notcve.org/view.php?id=CVE-2020-14363
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability. Se encontró una vulnerabilidad de desbordamiento de enteros conllevando a una doble liberación en libX11. Este fallo permite a un atacante privilegiado local causar que una aplicación compilada con libX11 se bloquee o, en algunos casos, resulte en una ejecución de código arbitraria. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14363 https://github.com/Ruia-ruia/Exploits/blob/master/DFX11details.txt https://github.com/Ruia-ruia/Exploits/blob/master/x11doublefree.sh https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7AVXCQOSCAPKYYHFIJAZ6E2C7LJBTLXF https://lists.x.org/archives/xorg-announce/2020-August/003056.html https://usn.ubuntu.com/4487-2 https://access.redhat.com/security/cve/CVE-2020-14363 https://bugzilla.redhat.com&#x • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free •
CVSS: 6.7EPSS: 0%CPEs: 11EXPL: 0CVE-2020-14344 – libX11: Heap overflow in the X input method client
https://notcve.org/view.php?id=CVE-2020-14344
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux. Se encontró un desbordamiento de enteros conllevando a un desbordamiento del búfer de la pila en el cliente X Input Method (XIM), se implementó en libX11 anterior a la versión 1.6.10. Según aguas arriba, esto es relevante para la seguridad cuando los programas setuid llaman a las funciones del cliente XIM mientras se ejecutan con privilegios elevados. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF https://lists.fedoraproject.org/ar • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-14598 – libX11: Crash on invalid reply in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14598
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault). Se ha descubierto un problema en XListExtensions en ListExt.c en libX11 hasta la versión 1.6.5. Un servidor malicioso puede enviar una respuesta en la cual la primera cadena se desborda, provocando que una variable se establezca como NULL y se libere posteriormente, lo que conduce a una denegación de servicio (fallo de segmentación). It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102073 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2018-14599 – libX11: Off-by-one error in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14599
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact. Se ha descubierto un problema en libX11 hasta su versión 1.6.5. La función XListExtensions en ListExt.c es vulnerable a un error por un paso provocado por respuestas maliciosas del servidor, lo que conduce a una denegación de servicio (DoS) o a otro tipo de impacto sin especificar. An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102062 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-193: Off-by-one Error CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 0CVE-2018-14600 – libX11: Out of Bounds write in XListExtensions in ListExt.c
https://notcve.org/view.php?id=CVE-2018-14600
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution. Se ha descubierto un problema en libX11 hasta su versión 1.6.5. La función XListExtensions en ListExt.c interpreta una variable como firmada en lugar de no firmada, lo que resulta en una escritura fuera de límites (de hasta 128 bytes), lo que conduce a una denegación de servicio (DoS) o a la ejecución remota de código. An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and XGetFontPath(). • http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securityfocus.com/bid/105177 http://www.securitytracker.com/id/1041543 https://access.redhat.com/errata/RHSA-2019:2079 https://bugzilla.suse.com/show_bug.cgi?id=1102068 https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://lists.x.org/archives/xorg-announce/2018-August/002916.html https://security. • CWE-787: Out-of-bounds Write •