9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.7%
Severity: High
Date : 2017-10-21
CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183
Package : xorg-server
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-443
The package xorg-server before version 1.19.5-1 is vulnerable to
arbitrary code execution.
Upgrade to 1.19.5-1.
The problems have been fixed upstream in version 1.19.5.
None.
A security issue has been found in xorg-server, due to a missing
validation of the extra length in ProcEstablishConnection().
A security issue has been found in the double buffer extension
component of xorg-server, due to a missing validation of the length of
a variable-length request in ProcDbeGetVisualInfo().
A security issue has been found in the Xi component of xorg-server, due
to an invalid length check in ProcXIChangeHierarchy.
A security issue has been found in the xfixes component of xorg-server,
where buffer lengths were not correctly validated.
An attacker able to connect to an X server, either locally or remotely,
can cause a denial of service by crashing the server, or execute
arbitrary code on the affected host.
https://lists.x.org/archives/xorg-devel/2017-October/054871.html
https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81
https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831
https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821
https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5
https://security.archlinux.org/CVE-2017-12176
https://security.archlinux.org/CVE-2017-12177
https://security.archlinux.org/CVE-2017-12178
https://security.archlinux.org/CVE-2017-12183
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | xorg-server | < 1.19.5-1 | UNKNOWN |
cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831
cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5
cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821
cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81
lists.x.org/archives/xorg-devel/2017-October/054871.html
security.archlinux.org/AVG-443
security.archlinux.org/CVE-2017-12176
security.archlinux.org/CVE-2017-12177
security.archlinux.org/CVE-2017-12178
security.archlinux.org/CVE-2017-12183
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.011 Low
EPSS
Percentile
84.7%