// For flags

CVE-2014-8091

xorg-x11-server: denial of service due to unchecked malloc in client authentication

Severity Score

4.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request.

X.Org X Window System (también conocido como X11 and X) X11R5 y X.Org Server (también conocido como xserver y xorg-server) anterior a 1.16.3, cuando utiliza las credenciales de autenticación SUN-DES-1 (Secure RPC), no compreuba el valor de retorno de una llamada malloc, lo que permite a atacantes remotos causar una denegación de servicio (referencia a puntero nulo y caída de servidor) a través de una solicitud de conexión manipulada.

It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Adjacent
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-10-10 CVE Reserved
  • 2014-12-09 CVE Published
  • 2024-07-22 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-252: Unchecked Return Value
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
X.org
Search vendor "X.org"
Xorg-server
Search vendor "X.org" for product "Xorg-server"
<= 1.16.2
Search vendor "X.org" for product "Xorg-server" and version " <= 1.16.2"
-
Affected
X.org
Search vendor "X.org"
X11
Search vendor "X.org" for product "X11"
5.0
Search vendor "X.org" for product "X11" and version "5.0"
-
Affected