Published: 13/02/2015 Updated: 30/10/2018

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

X.Org Server (aka xserver and xorg-server) prior to 1.16.3 and 1.17.x prior to 1.17.1 allows remote malicious users to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org xorg-server 1.17.0
x.org xorg-server
opensuse opensuse 13.2
opensuse opensuse 13.1

Debian Bug report logs - #774308 xserver-xorg: X-Server crashes when maximizing application windows (arithmetic exception in dix/mainc) Package: xorg-server; Maintainer for xorg-server is Debian X Strike Force <debian-x@listsdebianorg>; Reported by: Andreas Cord-Landwehr <cordlandwehr@kdeorg> Date: Wed, 31 Dec 201 ...

Several security issues were fixed in the XOrg X server ...

Olivier Fourdan discovered that missing input validation in the Xserver's handling of XkbSetGeometry requests may result in an information leak or denial of service For the stable distribution (wheezy), this problem has been fixed in version 2:1124-6+deb7u6 For the unstable distribution (sid), this problem has been fixed in version 2:1164-1 ...

A buffer over-read flaw was found in the way the XOrg server handled XkbGetGeometry requests A malicious, authorized client could use this flaw to disclose portions of the XOrg server memory, or cause the XOrg server to crash using a specially crafted XkbGetGeometry request (CVE-2015-0255) ...

CWE-200 http://www.debian.org/security/2015/dsa-3160 http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/http://lists.opensuse.org/opensuse-updates/2015-02/msg00086.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00085.html http://www.ubuntu.com/usn/USN-2500-1 http://www.mandriva.com/security/advisories?name=MDVSA-2015:119 http://advisories.mageia.org/MGASA-2015-0073.html http://rhn.redhat.com/errata/RHSA-2015-0797.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html https://security.gentoo.org/glsa/201504-06 http://www.securityfocus.com/bid/72578 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774308 https://usn.ubuntu.com/2500-1/https://nvd.nist.gov

CVE-2015-0255

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect