CVE-2018-14598
libX11: Crash on invalid reply in XListExtensions in ListExt.c
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
Se ha descubierto un problema en XListExtensions en ListExt.c en libX11 hasta la versión 1.6.5. Un servidor malicioso puede enviar una respuesta en la cual la primera cadena se desborda, provocando que una variable se establezca como NULL y se libere posteriormente, lo que conduce a una denegación de servicio (fallo de segmentación).
It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-07-26 CVE Reserved
- 2018-08-21 CVE Published
- 2024-03-19 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (14)
URL | Tag | Source |
---|---|---|
http://www.openwall.com/lists/oss-security/2018/08/21/6 | Mailing List | |
http://www.securityfocus.com/bid/105177 | Third Party Advisory | |
http://www.securitytracker.com/id/1041543 | Third Party Advisory | |
https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html | Mailing List | |
https://lists.x.org/archives/xorg-announce/2018-August/002916.html | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.suse.com/show_bug.cgi?id=1102073 | 2023-11-07 | |
https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2 | 2023-11-07 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2019:2079 | 2023-11-07 | |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F | 2023-11-07 | |
https://security.gentoo.org/glsa/201811-01 | 2023-11-07 | |
https://usn.ubuntu.com/3758-1 | 2023-11-07 | |
https://usn.ubuntu.com/3758-2 | 2023-11-07 | |
https://access.redhat.com/security/cve/CVE-2018-14598 | 2019-08-06 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1623238 | 2019-08-06 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
X.org Search vendor "X.org" | Libx11 Search vendor "X.org" for product "Libx11" | <= 1.6.5 Search vendor "X.org" for product "Libx11" and version " <= 1.6.5" | - |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | esm |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 28 Search vendor "Fedoraproject" for product "Fedora" and version "28" | - |
Affected
|