// For flags

CVE-2013-1995

libXi: Sign extension issues resulting in heap-based buffer overflow

Severity Score

6.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

X.org libXi 1.7.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the XListInputDevices function.

X.org LibXi v1.7.1 y anteriores permite a los servidores X activar la asignación de memoria insuficiente y provocar un desbordamiento de búfer a través de vectores relacionados con una extensión de signo inesperada en la función XListInputDevices.

A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11's libXi runtime library handled signed numbers. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Adjacent
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2013-02-19 CVE Reserved
  • 2013-05-23 CVE Published
  • 2024-07-09 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-122: Heap-based Buffer Overflow
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
<= 1.7.1
Search vendor "X.org" for product "Libxi" and version " <= 1.7.1"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.5.0
Search vendor "X.org" for product "Libxi" and version "1.5.0"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.5.99.2
Search vendor "X.org" for product "Libxi" and version "1.5.99.2"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.5.99.3
Search vendor "X.org" for product "Libxi" and version "1.5.99.3"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.6.0
Search vendor "X.org" for product "Libxi" and version "1.6.0"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.6.1
Search vendor "X.org" for product "Libxi" and version "1.6.1"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.6.2
Search vendor "X.org" for product "Libxi" and version "1.6.2"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.6.99.1
Search vendor "X.org" for product "Libxi" and version "1.6.99.1"
-
Affected
X.org
Search vendor "X.org"
Libxi
Search vendor "X.org" for product "Libxi"
1.7
Search vendor "X.org" for product "Libxi" and version "1.7"
-
Affected