CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2014-8102 – xorg-x11-server: out of bounds access due to not validating length or offset values in XFixes extension
https://notcve.org/view.php?id=CVE-2014-8102
The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value. La función SProcXFixesSelectSelectionInput en la extensión XFixes en X.Org X Window System (también conocido como X11 o X) X11R6.8.0 y X.Org Server (también conocido como xserver y xorg-server) anterior a 1.16.3 permite a usuarios remotos autenticados causar una denegación de servicio (lectura o escritura fuera de rango) o posiblemente ejecutar código arbitrario a través de un valor de longitud manipulado. Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. • http://advisories.mageia.org/MGASA-2014-0532.html http://secunia.com/advisories/61947 http://secunia.com/advisories/62292 http://www.debian.org/security/2014/dsa-3095 http://www.mandriva.com/security/advisories?name=MDVSA-2015:119 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.securityfocus.com/bid/71608& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2014-8103 – xorg-x11-server: out of bounds access due to not validating length or offset values in DRI3 & Present extensions
https://notcve.org/view.php?id=CVE-2014-8103
X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) sproc_dri3_query_version, (2) sproc_dri3_open, (3) sproc_dri3_pixmap_from_buffer, (4) sproc_dri3_buffer_from_pixmap, (5) sproc_dri3_fence_from_fd, (6) sproc_dri3_fd_from_fence, (7) proc_present_query_capabilities, (8) sproc_present_query_version, (9) sproc_present_pixmap, (10) sproc_present_notify_msc, (11) sproc_present_select_input, or (12) sproc_present_query_capabilities function in the (a) DRI3 or (b) Present extension. X.Org Server (también conocido como xserver y xorg-server) 1.15.0 hasta 1.16.x anterior a 1.16.3 permite a usuarios remotos autenticados causar una denegación de servicio (lectura o escritura fuera de rango) o posiblemente ejecutar código arbitrario a través de un valor de longitud o de indice manipulado en la función (1) sproc_dri3_query_version, (2) sproc_dri3_open, (3) sproc_dri3_pixmap_from_buffer, (4) sproc_dri3_buffer_from_pixmap, (5) sproc_dri3_fence_from_fd, (6) sproc_dri3_fd_from_fence, (7) proc_present_query_capabilities, (8) sproc_present_query_version, (9) sproc_present_pixmap, (10) sproc_present_notify_msc, (11) sproc_present_select_input, o (12) sproc_present_query_capabilities en la extensión (a) DRI3 o (b) Present. Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. • http://secunia.com/advisories/61947 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.x.org/wiki/Development/Security/Advisory-2014-12-09 https://security.gentoo.org/glsa/201504-06 https://access.redhat.com/security/cve/CVE-2014-8103 https://bugzilla.redhat.com/show_bug.cgi?id=1168716 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2007-4730 – X.org composite extension buffer overflow
https://notcve.org/view.php?id=CVE-2007-4730
Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap. Desbordamiento de búfer en la función compNewPixmap de compalloc.c en la extensión Composite para el servidor X11 X.org anterior a 1.4 permite a usuarios locales ejecutar código de su elección copiando datos de un mapa de píxeles con gran profundidad de píxel (pixel depth) a un mapa con profundidad menor. • http://bugs.freedesktop.org/show_bug.cgi?id=7447 http://bugs.gentoo.org/show_bug.cgi?id=191964 http://lists.freedesktop.org/archives/xorg-announce/2007-September/000378.html http://osvdb.org/37726 http://secunia.com/advisories/26743 http://secunia.com/advisories/26755 http://secunia.com/advisories/26763 http://secunia.com/advisories/26823 http://secunia.com/advisories/26859 http://secunia.com/advisories/26897 http://secunia.com/advisories/27147 http://secunia.com/adviso • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 14EXPL: 0CVE-2006-4447
https://notcve.org/view.php?id=CVE-2006-4447
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit. X.Org y XFree86, incluyendo libX11, xdm, xf86dga, xinit, xload, xtrans, y xterm, no comprueban los valores de retorno de las llamadas a setuid y seteuid al intentar eliminar privilegios, lo cual permite a usuarios locales obtener privilegios haciendo fallar estas llamadas, como por ejemplo excediendo un ulimit. • http://lists.freedesktop.org/archives/xorg/2006-June/016146.html http://mail.gnome.org/archives/beast/2006-December/msg00025.html http://secunia.com/advisories/21650 http://secunia.com/advisories/21660 http://secunia.com/advisories/21693 http://secunia.com/advisories/22332 http://secunia.com/advisories/25032 http://secunia.com/advisories/25059 http://security.gentoo.org/glsa/glsa-200608-25.xml http://security.gentoo.org/glsa/glsa-200704-22.xml http://www.debian.org/securit •