Published: 24/08/2018 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

An issue exists in XListExtensions in ListExt.c in libX11 up to and including 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org libx11
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 18.04
fedoraproject fedora 28

Synopsis Moderate: Xorg security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for Xorg is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sco ...

Several security issues were fixed in libx11 ...

An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts() An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption (CVE-2018-14599) It was dis ...

It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory An attacker who can either configure a malicious X server or modify the data coming fr ...

CWE-20 https://lists.x.org/archives/xorg-announce/2018-August/002916.html https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2 https://bugzilla.suse.com/show_bug.cgi?id=1102073 http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securitytracker.com/id/1041543 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://usn.ubuntu.com/3758-2/http://www.securityfocus.com/bid/105177 https://usn.ubuntu.com/3758-1/https://security.gentoo.org/glsa/201811-01 https://access.redhat.com/errata/RHSA-2019:2079 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F/https://access.redhat.com/errata/RHSA-2019:2079 https://nvd.nist.gov https://usn.ubuntu.com/3758-2/

CVE-2018-14598

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect