CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25712 – X.Org Server XkbSetDeviceInfo Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-25712
A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en xorg-x11-server versiones anteriores a 1.20.10. Un desbordamiento del búfer de la pila en la función XkbSetDeviceInfo puede causar una vulnerabilidad de escalada de privilegios. • https://bugzilla.redhat.com/show_bug.cgi?id=1887276 https://lists.x.org/archives/xorg-announce/2020-December/003066.html https://access.redhat.com/security/cve/CVE-2020-25712 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14360 – X.Org Server XkbSetMap Out-Of-Bounds Access Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-14360
A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en el servidor X.Org anterior a la versión 1.20.10. Un acceso fuera de límites en la función XkbSetMap puede conllevar a una vulnerabilidad de escalada de privilegios. • https://bugzilla.redhat.com/show_bug.cgi?id=1869139 https://lists.x.org/archives/xorg-announce/2020-December/003066.html https://access.redhat.com/security/cve/CVE-2020-14360 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-14345 – X.Org Server XkbSetNames Out-Of-Bounds Access Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-14345
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en X.Org Server versiones anteriores a xorg-x11-server 1.20.9. Un acceso fuera de límites en la función XkbSetNames puede conllevar a una vulnerabilidad de escalada de privilegios. • http://www.openwall.com/lists/oss-security/2021/01/15/1 https://bugzilla.redhat.com/show_bug.cgi?id=1862241 https://lists.x.org/archives/xorg-announce/2020-August/003058.html https://security.gentoo.org/glsa/202012-01 https://usn.ubuntu.com/4488-2 https://usn.ubuntu.com/4490-1 https://www.zerodayinitiative.com/advisories/ZDI-20-1416 https://access.redhat.com/security/cve/CVE-2020-14345 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17624 – X.Org X Server 1.20.4 - Local Stack Overflow
https://notcve.org/view.php?id=CVE-2019-17624
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact. Note: It is disputed if the X.Org X Server is involved or if there is a stack overflow. En X.Org X Server versión 1.20.4, se presenta un desbordamiento de búfer en la región stack de la memoria en la función XQueryKeymap. Por ejemplo, al enviar ct.c_char 1000 veces, un atacante puede causar una denegación de servicio (bloqueo de aplicación) o posiblemente tener otro impacto no especificado. • https://www.exploit-db.com/exploits/47507 http://packetstormsecurity.com/files/154868/X.Org-X-Server-1.20.4-Local-Stack-Overflow.html https://www.x.org/releases/individual/xserver • CWE-787: Out-of-bounds Write •
CVSS: 4.6EPSS: 0%CPEs: 7EXPL: 1CVE-2011-4613 – X.Org xorg 1.4 < 1.11.2 - File Permission Change
https://notcve.org/view.php?id=CVE-2011-4613
The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY. El wrapper de las X de X.org (xserver-wrapper.c) en Debian GNU/Linux and Ubuntu Linux no verifica debidamente la TTY de un usuario que está arrancando las X, lo cual permite a usuarios locales evadir restricciones de acceso mediante las asociación de stdin con un archivo que es malinterpretado como la consola TTY. • https://www.exploit-db.com/exploits/18040 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652249 http://www.debian.org/security/2011/dsa-2364 http://www.ubuntu.com/usn/USN-1349-1 • CWE-264: Permissions, Privileges, and Access Controls •