[SECURITY] [DLA 2486-1] xorg-server security update

2020-12-0910:27:48

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.3%

JSON

Debian LTS Advisory DLA-2486-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
December 09, 2020 https://wiki.debian.org/LTS

Package : xorg-server
Version : 2:1.19.2-1+deb9u7
CVE ID : CVE-2020-14360 CVE-2020-25712

Jan-Niklas Sohn discovered that the XKB extension of the Xorg X server
performed incomplete input validation, which could result in privilege
escalation.

For Debian 9 stretch, these problems have been fixed in version
2:1.19.2-1+deb9u7.

We recommend that you upgrade your xorg-server packages.

For the detailed security status of xorg-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xorg-server

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9amd64xdmx< 2:1.19.2-1+deb9u7xdmx_2:1.19.2-1+deb9u7_amd64.deb
Debian10s390xxdmx-dbgsym< 2:1.20.4-1+deb10u2xdmx-dbgsym_2:1.20.4-1+deb10u2_s390x.deb
Debian10mips64elxvfb-dbgsym< 2:1.20.4-1+deb10u2xvfb-dbgsym_2:1.20.4-1+deb10u2_mips64el.deb
Debian10armhfxvfb< 2:1.20.4-1+deb10u2xvfb_2:1.20.4-1+deb10u2_armhf.deb
Debian9arm64xserver-xorg-dev< 2:1.19.2-1+deb9u7xserver-xorg-dev_2:1.19.2-1+deb9u7_arm64.deb
Debian10mips64elxserver-xorg-core< 2:1.20.4-1+deb10u2xserver-xorg-core_2:1.20.4-1+deb10u2_mips64el.deb
Debian10armhfxnest-dbgsym< 2:1.20.4-1+deb10u2xnest-dbgsym_2:1.20.4-1+deb10u2_armhf.deb
Debian9i386xnest< 2:1.19.2-1+deb9u7xnest_2:1.19.2-1+deb9u7_i386.deb
Debian10mips64elxserver-xephyr-dbgsym< 2:1.20.4-1+deb10u2xserver-xephyr-dbgsym_2:1.20.4-1+deb10u2_mips64el.deb
Debian9armelxnest< 2:1.19.2-1+deb9u7xnest_2:1.19.2-1+deb9u7_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	xdmx	< 2:1.19.2-1+deb9u7	xdmx_2:1.19.2-1+deb9u7_amd64.deb
Debian	10	s390x	xdmx-dbgsym	< 2:1.20.4-1+deb10u2	xdmx-dbgsym_2:1.20.4-1+deb10u2_s390x.deb
Debian	10	mips64el	xvfb-dbgsym	< 2:1.20.4-1+deb10u2	xvfb-dbgsym_2:1.20.4-1+deb10u2_mips64el.deb
Debian	10	armhf	xvfb	< 2:1.20.4-1+deb10u2	xvfb_2:1.20.4-1+deb10u2_armhf.deb
Debian	9	arm64	xserver-xorg-dev	< 2:1.19.2-1+deb9u7	xserver-xorg-dev_2:1.19.2-1+deb9u7_arm64.deb
Debian	10	mips64el	xserver-xorg-core	< 2:1.20.4-1+deb10u2	xserver-xorg-core_2:1.20.4-1+deb10u2_mips64el.deb
Debian	10	armhf	xnest-dbgsym	< 2:1.20.4-1+deb10u2	xnest-dbgsym_2:1.20.4-1+deb10u2_armhf.deb
Debian	9	i386	xnest	< 2:1.19.2-1+deb9u7	xnest_2:1.19.2-1+deb9u7_i386.deb
Debian	10	mips64el	xserver-xephyr-dbgsym	< 2:1.20.4-1+deb10u2	xserver-xephyr-dbgsym_2:1.20.4-1+deb10u2_mips64el.deb
Debian	9	armel	xnest	< 2:1.19.2-1+deb9u7	xnest_2:1.19.2-1+deb9u7_armel.deb