Lucene search

K
mageiaGentoo FoundationMGASA-2015-0073
HistoryFeb 17, 2015 - 9:38 p.m.

Updated x11-server packages fix CVE-2015-0255

2015-02-1721:38:13
Gentoo Foundation
advisories.mageia.org
14

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.079 Low

EPSS

Percentile

94.2%

Updated x11-server packages fix security vulnerability: Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request, where the server trusts the client to send valid string lengths. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. This can lead to information disclosure issues, as well as possibly a denial of service if a similar request can cause the server to crash (CVE-2015-0255).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchx11-server< 1.14.5-2.3x11-server-1.14.5-2.3.mga4

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.079 Low

EPSS

Percentile

94.2%