Published: 24/08/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An issue exists in libX11 up to and including 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org libx11
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 18.04
fedoraproject fedora 28
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0

Synopsis Moderate: Xorg security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for Xorg is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base sco ...

Several security issues were fixed in libx11 ...

An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts() An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption (CVE-2018-14599) It was dis ...

It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory An attacker who can either configure a malicious X server or modify the data coming fr ...

An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts() An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption ...

CWE-193 https://lists.x.org/archives/xorg-announce/2018-August/002916.html https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0 https://bugzilla.suse.com/show_bug.cgi?id=1102062 http://www.openwall.com/lists/oss-security/2018/08/21/6 http://www.securitytracker.com/id/1041543 https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html https://usn.ubuntu.com/3758-2/http://www.securityfocus.com/bid/105177 https://usn.ubuntu.com/3758-1/https://security.gentoo.org/glsa/201811-01 https://access.redhat.com/errata/RHSA-2019:2079 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F/https://access.redhat.com/errata/RHSA-2019:2079 https://usn.ubuntu.com/3758-2/https://nvd.nist.gov

CVE-2018-14599

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect