CVE-2020-14363
libX11: integer overflow leads to double free in locale handling
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability.
Se encontró una vulnerabilidad de desbordamiento de enteros conllevando a una doble liberación en libX11. Este fallo permite a un atacante privilegiado local causar que una aplicación compilada con libX11 se bloquee o, en algunos casos, resulte en una ejecución de código arbitraria. La mayor amenaza de este fallo es la confidencialidad, la integridad y la disponibilidad del sistema
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Mesa provides a 3D graphics API that is compatible with Open Graphics Library. It also provides hardware-accelerated drivers for many popular graphics chips. Issues addressed include buffer overflow, double free, heap overflow, integer overflow, out of bounds access, and privilege escalation vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-06-17 CVE Reserved
- 2020-08-28 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-04-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-190: Integer Overflow or Wraparound
- CWE-416: Use After Free
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14363 | Issue Tracking | |
| https://github.com/Ruia-ruia/Exploits/blob/master/DFX11details.txt | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/Ruia-ruia/Exploits/blob/master/x11doublefree.sh | 2024-08-04 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| X.org Search vendor "X.org" | Libx11 Search vendor "X.org" for product "Libx11" | < 1.6.12 Search vendor "X.org" for product "Libx11" and version " < 1.6.12" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||