7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.1 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:P/I:P/A:C
0.001 Low
EPSS
Percentile
25.3%
Severity: Medium
Date : 2020-12-05
CVE-ID : CVE-2020-14360 CVE-2020-25712
Package : xorg-server
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1310
The package xorg-server before version 1.20.10-1 is vulnerable to
arbitrary code execution.
Upgrade to 1.20.10-1.
The problems have been fixed upstream in version 1.20.10.
None.
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on the lengths of the XkbSetMap request can lead to
out of bounds memory accesses in the X server. This issue can lead to
privilege escalation for authorized clients on systems where the X
server is running privileged.
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on input of the XkbSetDeviceInfo request can lead
to a buffer overflow on the head in the X server. This issue can lead
to privilege escalation for authorized clients on systems where the X
server is running privileged.
A local attacker might be able to escalate privileges.
https://www.openwall.com/lists/oss-security/2020/12/01/3
https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b
https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9
https://security.archlinux.org/CVE-2020-14360
https://security.archlinux.org/CVE-2020-25712
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | xorg-server | < 1.20.10-1 | UNKNOWN |
gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b
gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9
security.archlinux.org/AVG-1310
security.archlinux.org/CVE-2020-14360
security.archlinux.org/CVE-2020-25712
www.openwall.com/lists/oss-security/2020/12/01/3
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.1 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:P/I:P/A:C
0.001 Low
EPSS
Percentile
25.3%