{"id": "ELSA-2011-0432", "bulletinFamily": "unix", "title": "xorg-x11 security update", "description": "[6.8.2-1.0.1.EL.67]\n- Add Enterprise Linux detection\n Add XFree86-4.3.0-oracle-bug-report-address-update.patch\n[6.8.2-1.EL.67]\n- cve-2011-0465.patch: Sanitize cpp macro expansion. (CVE 2011-0465)", "published": "2011-04-11T00:00:00", "modified": "2011-04-11T00:00:00", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "href": "http://linux.oracle.com/errata/ELSA-2011-0432.html", "reporter": "Oracle", "references": [], "cvelist": ["CVE-2011-0465"], "type": "oraclelinux", "lastseen": "2019-05-29T18:38:10", "edition": 4, "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-0465"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310870421", "OPENVAS:69580", "OPENVAS:840631", "OPENVAS:880499", "OPENVAS:1361412562310831377", "OPENVAS:1361412562310840631", "OPENVAS:863274", "OPENVAS:1361412562310870420", "OPENVAS:1361412562310122194", "OPENVAS:136141256231069580"]}, {"type": "nessus", "idList": ["SUSE_11_XORG-X11-110323.NASL", "SUSE_11_2_XORG-X11-110405.NASL", "DEBIAN_DSA-2213.NASL", "SLACKWARE_SSA_2011-096-01.NASL", "MANDRIVA_MDVSA-2011-076.NASL", "SUSE_11_4_XORG-X11-110405.NASL", "ORACLELINUX_ELSA-2011-0433.NASL", "SOLARIS10_147227-01.NASL", "SUSE_XORG-X11-7417.NASL", "REDHAT-RHSA-2011-0432.NASL"]}, {"type": "suse", "idList": ["SUSE-SA:2011:016"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:11575", "SECURITYVULNS:DOC:26094"]}, {"type": "freebsd", "idList": ["2ECCB24F-61C0-11E0-B199-0015F2DB7BDE"]}, {"type": "ubuntu", "idList": ["USN-1107-1"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2213-1:19551"]}, {"type": "redhat", "idList": ["RHSA-2011:0432", "RHSA-2011:0433"]}, {"type": "oraclelinux", "idList": ["ELSA-2011-0433"]}, {"type": "centos", "idList": ["CESA-2011:0433", "CESA-2011:0432"]}, {"type": "slackware", "idList": ["SSA-2011-096-01"]}, {"type": "gentoo", "idList": ["GLSA-201412-09"]}], "modified": "2019-05-29T18:38:10", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2019-05-29T18:38:10", "rev": 2}, "vulnersScore": 7.3}, "affectedPackage": [{"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-devel-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-Xvfb-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-Xvfb", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-devel-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-deprecated-libs-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-doc-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-doc", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-libs-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-deprecated-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-deprecated-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-deprecated-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-tools-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-tools", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-Xnest-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-Xnest", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-doc-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-doc", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-tools-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-tools", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-xauth-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-xauth", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-libs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-deprecated-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-libs-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-xfs-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-xfs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-doc-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-doc", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Xnest-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Xnest", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-font-utils-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-font-utils", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-xauth-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-xauth", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "src", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.src.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "src", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.src.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "src", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.src.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-Xvfb-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-Xvfb", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-devel-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-tools-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-tools", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-devel-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-devel-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-twm-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-twm", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Xdmx-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Xdmx", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-xdm-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-xdm", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-Mesa-libGL", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-sdk-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-sdk", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-Xnest-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-Xnest", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGLU", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGLU", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGLU", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-devel-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-deprecated-libs-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-devel-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-deprecated-libs-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-twm-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-twm", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-Mesa-libGLU", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-xauth-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-xauth", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-font-utils-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-font-utils", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-sdk-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-sdk", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-Xdmx-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-Xdmx", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-xdm-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-xdm", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-deprecated-libs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-deprecated-libs-devel-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-deprecated-libs-devel", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-font-utils-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-font-utils", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-xfs-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-xfs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-Mesa-libGLU", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Xvfb-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Xvfb", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-sdk-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-sdk", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGL", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGL", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-Mesa-libGL", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-Mesa-libGL", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-xfs-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-xfs", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "ia64", "operator": "lt", "packageFilename": "xorg-x11-Xdmx-6.8.2-1.0.1.EL.67.ia64.rpm", "packageName": "xorg-x11-Xdmx", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "x86_64", "operator": "lt", "packageFilename": "xorg-x11-twm-6.8.2-1.0.1.EL.67.x86_64.rpm", "packageName": "xorg-x11-twm", "packageVersion": "6.8.2-1.0.1.EL.67"}, {"OS": "Oracle Linux", "OSVersion": "4", "arch": "i386", "operator": "lt", "packageFilename": "xorg-x11-xdm-6.8.2-1.0.1.EL.67.i386.rpm", "packageName": "xorg-x11-xdm", "packageVersion": "6.8.2-1.0.1.EL.67"}], "scheme": null}

{"cve": [{"lastseen": "2020-12-09T19:39:03", "description": "xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.", "edition": 5, "cvss3": {}, "published": "2011-04-08T15:17:00", "title": "CVE-2011-0465", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-0465"], "modified": "2017-08-17T01:33:00", "cpe": ["cpe:/a:x:x11:r6.9.0", "cpe:/a:x:x11:r6.6", "cpe:/a:x:x11:r7.4", "cpe:/a:x:x11:r7.2", "cpe:/a:matthias_hopf:xrdb:1.0.4", "cpe:/a:x:x11:r7.3", "cpe:/a:x:x11:r3", "cpe:/a:matthias_hopf:xrdb:1.0.5", "cpe:/a:matthias_hopf:xrdb:1.0.3", "cpe:/a:x:x11:r7.1", "cpe:/a:x:x11:r5", "cpe:/a:x:x11:r6.7", "cpe:/a:matthias_hopf:xrdb:1.0.8", "cpe:/a:matthias_hopf:xrdb:1.0.7", "cpe:/a:x:x11:r6.8.2", "cpe:/a:x:x11:r6.3", "cpe:/a:x:x11:r7.0", "cpe:/a:x:x11:r6.5.1", "cpe:/a:x:x11:r6.4", "cpe:/a:matthias_hopf:xrdb:1.0.2", "cpe:/a:x:x11:r6.1", "cpe:/a:x:x11:r6", "cpe:/a:x:x11:r6.8.0", "cpe:/a:x:x11:r2", "cpe:/a:x:x11:r6.8.1", "cpe:/a:x:x11:r6.7.0", "cpe:/a:x:x11:r7.5", "cpe:/a:x:x11:r4", "cpe:/a:x:x11:r1", "cpe:/a:matthias_hopf:xrdb:1.0.6", "cpe:/a:x:x11:r7.6"], "id": "CVE-2011-0465", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0465", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:x:x11:r6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r5:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.0:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.6:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.6:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.4:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.3:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.1:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.5:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.3:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.1:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r2:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r1:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r3:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.7:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r7.2:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r4:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:matthias_hopf:xrdb:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:x:x11:r6.4:*:*:*:*:*:*:*"]}], "centos": [{"lastseen": "2019-12-20T18:29:22", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "**CentOS Errata and Security Advisory** CESA-2011:0432\n\n\nX.Org is an open source implementation of the X Window System. It provides\nthe basic low-level functionality that full-fledged graphical user\ninterfaces are designed upon.\n\nA flaw was found in the X.Org X server resource database utility, xrdb.\nCertain variables were not properly sanitized during the launch of a user's\ngraphical session, which could possibly allow a remote attacker to execute\narbitrary code with root privileges, if they were able to make the display\nmanager execute xrdb with a specially-crafted X client hostname. For\nexample, by configuring the hostname on the target system via a crafted\nDHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\nconnect to that system from a host that has a special DNS name.\n(CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\noriginal reporter.\n\nUsers of xorg-x11 should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-April/029451.html\n\n**Affected packages:**\nxorg-x11\nxorg-x11-Mesa-libGL\nxorg-x11-Mesa-libGLU\nxorg-x11-Xdmx\nxorg-x11-Xnest\nxorg-x11-Xvfb\nxorg-x11-deprecated-libs\nxorg-x11-deprecated-libs-devel\nxorg-x11-devel\nxorg-x11-doc\nxorg-x11-font-utils\nxorg-x11-libs\nxorg-x11-sdk\nxorg-x11-tools\nxorg-x11-twm\nxorg-x11-xauth\nxorg-x11-xdm\nxorg-x11-xfs\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2011-0432.html", "edition": 4, "modified": "2011-04-19T13:15:11", "published": "2011-04-19T13:15:11", "href": "http://lists.centos.org/pipermail/centos-announce/2011-April/029451.html", "id": "CESA-2011:0432", "title": "xorg security update", "type": "centos", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-20T18:24:42", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "**CentOS Errata and Security Advisory** CESA-2011:0433\n\n\nThe xorg-x11-server-utils package contains a collection of utilities used\nto modify and query the runtime configuration of the X.Org server. X.Org is\nan open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility, xrdb.\nCertain variables were not properly sanitized during the launch of a user's\ngraphical session, which could possibly allow a remote attacker to execute\narbitrary code with root privileges, if they were able to make the display\nmanager execute xrdb with a specially-crafted X client hostname. For\nexample, by configuring the hostname on the target system via a crafted\nDHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\nconnect to that system from a host that has a special DNS name.\n(CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\noriginal reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running X.Org\nserver instances must be restarted for this update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2011-April/029359.html\nhttp://lists.centos.org/pipermail/centos-announce/2011-April/029360.html\n\n**Affected packages:**\nxorg-x11-server-utils\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2011-0433.html", "edition": 3, "modified": "2011-04-14T15:07:49", "published": "2011-04-14T15:07:49", "href": "http://lists.centos.org/pipermail/centos-announce/2011-April/029359.html", "id": "CESA-2011:0433", "title": "xorg security update", "type": "centos", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "slackware": [{"lastseen": "2020-10-25T16:36:04", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "New xrdb packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,\nand -current to fix a security issue.\n\n\nHere are the details from the Slackware 13.1 ChangeLog:\n\npatches/packages/xrdb-1.0.9-i486-1_slack13.1.txz: Upgraded.\n This fixes a security issue where improperly sanitized input could lead to\n privilege escalation or arbitrary command execution as root.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0465\n (* Security fix *)\n\nWhere to find the new packages:\n\nHINT: Getting slow download speeds from ftp.slackware.com?\nGive slackware.osuosl.org a try. This is another primary FTP site\nfor Slackware that can be considerably faster than downloading\ndirectly from ftp.slackware.com.\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating additional FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 12.0:\nftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/xrdb-1.0.9-i486-1_slack12.0.tgz\n\nUpdated package for Slackware 12.1:\nftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/xrdb-1.0.9-i486-1_slack12.1.tgz\n\nUpdated package for Slackware 12.2:\nftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/xrdb-1.0.9-i486-1_slack12.2.tgz\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/xrdb-1.0.9-i486-1_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/xrdb-1.0.9-x86_64-1_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/xrdb-1.0.9-i486-1_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/xrdb-1.0.9-x86_64-1_slack13.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xrdb-1.0.9-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xrdb-1.0.9-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 12.0 package:\n32527c76943707b282a3f4b084e1f4d6 xrdb-1.0.9-i486-1_slack12.0.tgz\n\nSlackware 12.1 package:\na1ac49f09f1b14caee33d508aaced37c xrdb-1.0.9-i486-1_slack12.1.tgz\n\nSlackware 12.2 package:\n7b102c0a2a6173f945fa95ad9098a86f xrdb-1.0.9-i486-1_slack12.2.tgz\n\nSlackware 13.0 package:\n1ea7bd9486efaccdf520d71997c42681 xrdb-1.0.9-i486-1_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n8a070b5dea8b98cf4defb9cb7a14f019 xrdb-1.0.9-x86_64-1_slack13.0.txz\n\nSlackware 13.1 package:\nf86dd76e5e164c3e5e471063597fe50e xrdb-1.0.9-i486-1_slack13.1.txz\n\nSlackware x86_64 13.1 package:\na1f5e38934e69dd20ecb93ccc3e45331 xrdb-1.0.9-x86_64-1_slack13.1.txz\n\nSlackware -current package:\n82f546e63687aeaa6e6921bdfddbe403 x/xrdb-1.0.9-i486-1.txz\n\nSlackware x86_64 -current package:\nf2e9fec7c1cc69ae0ae76db68ae4b930 x/xrdb-1.0.9-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg xrdb-1.0.9-i486-1_slack13.1.txz", "modified": "2011-04-11T21:56:44", "published": "2011-04-11T21:56:44", "id": "SSA-2011-096-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.465748", "type": "slackware", "title": "[slackware-security] xrdb", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-09T01:39:12", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "Sebastian Krahmer discovered that the xrdb utility incorrectly filtered \ncrafted hostnames. An attacker could use this flaw with a malicious \nDHCP server or with a remote xdmcp login and execute arbitrary code, \nresulting in root privilege escalation.", "edition": 5, "modified": "2011-04-06T00:00:00", "published": "2011-04-06T00:00:00", "id": "USN-1107-1", "href": "https://ubuntu.com/security/notices/USN-1107-1", "title": "x11-xserver-utils vulnerability", "type": "ubuntu", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2016-09-04T12:09:52", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "The xrdb helper program of the xorg-x11 package passes untrusted input such as hostnames retrieved via DHCP or client hostnames of XDMCP sessions to popen() without sanitization. Therefore, remote attackers could execute arbitrary commands as root by assigning specially crafted hostnames to X11 servers or to XDMCP clients. CVE-2011-0465 has been assigned to this issue.\n#### Solution\nThere is no known workaround, please install the update packages.", "edition": 1, "modified": "2011-04-13T13:39:33", "published": "2011-04-13T13:39:33", "id": "SUSE-SA:2011:016", "href": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00002.html", "title": "remote code execution in xorg-x11", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "debian": [{"lastseen": "2020-08-12T01:05:52", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2213-1 security@debian.org\nhttp://www.debian.org/security/ Nico Golde\nApril 8, 2011 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : x11-xserver-utils\nVulnerability : missing input sanitization\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2011-0465\nDebian bug : 621423\n\nSebastian Krahmer discovered that the xrdb utility of x11-xserver-utils,\na X server resource database utility, is not properly filtering crafted\nhostnames. This allows a remote attacker to execute arbitrary code with\nroot privileges given that either remote logins via xdmcp are allowed or\nthe attacker is able to place a rogue DHCP server into the victims network.\n\n\nThe oldstable distribution (lenny), this problem has been fixed in\nversion 7.3+6.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 7.5+3.\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\nFor the testing distribution (sid), this problem has been fixed in\nversion 7.6+2.\n\n\nWe recommend that you upgrade your x11-xserver-utils packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n\n", "edition": 10, "modified": "2011-04-08T20:09:11", "published": "2011-04-08T20:09:11", "id": "DEBIAN:DSA-2213-1:19551", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2011/msg00082.html", "title": "[SECURITY] [DSA 2213-1] x11-xserver-utils security update", "type": "debian", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:41", "bulletinFamily": "software", "cvelist": ["CVE-2011-0465"], "description": "Shell characters vulnerability via host name.", "edition": 1, "modified": "2011-04-11T00:00:00", "published": "2011-04-11T00:00:00", "id": "SECURITYVULNS:VULN:11575", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11575", "title": "XRDB shell characters vulnerability", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:39", "bulletinFamily": "software", "cvelist": ["CVE-2011-0465"], "description": "===========================================================\r\nUbuntu Security Notice USN-1107-1 April 06, 2011\r\nx11-xserver-utils vulnerability\r\nCVE-2011-0465\r\n===========================================================\r\n\r\nA security issue affects the following Ubuntu releases:\r\n\r\nUbuntu 8.04 LTS\r\nUbuntu 9.10\r\nUbuntu 10.04 LTS\r\nUbuntu 10.10\r\n\r\nThis advisory also applies to the corresponding versions of\r\nKubuntu, Edubuntu, and Xubuntu.\r\n\r\nThe problem can be corrected by upgrading your system to the\r\nfollowing package versions:\r\n\r\nUbuntu 8.04 LTS:\r\n x11-xserver-utils 7.3+2ubuntu0.1\r\n\r\nUbuntu 9.10:\r\n x11-xserver-utils 7.4+2ubuntu3.1\r\n\r\nUbuntu 10.04 LTS:\r\n x11-xserver-utils 7.5+1ubuntu2.1\r\n\r\nUbuntu 10.10:\r\n x11-xserver-utils 7.5+2ubuntu1.1\r\n\r\nAfter a standard system update you need to reboot your computer to make\r\nall the necessary changes.\r\n\r\nDetails follow:\r\n\r\nSebastian Krahmer discovered that the xrdb utility incorrectly filtered\r\ncrafted hostnames. An attacker could use this flaw with a malicious\r\nDHCP server or with a remote xdmcp login and execute arbitrary code,\r\nresulting in root privilege escalation.\r\n\r\n\r\nUpdated packages for Ubuntu 8.04 LTS:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1.dsc\r\n Size/MD5: 1855 ed72ba7905552c8ad970eb9b6ea65735\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1.tar.gz\r\n Size/MD5: 1993520 fbcfdc97544d06d5956b553f154024a9\r\n\r\n amd64 architecture &#40;Athlon64, Opteron, EM64T Xeon&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1_amd64.deb\r\n Size/MD5: 188578 55c51ac356a4c206986993426ef9c89a\r\n\r\n i386 architecture &#40;x86 compatible Intel/AMD&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1_i386.deb\r\n Size/MD5: 173526 cff268921d0c6c4b0be4bd053c7a32ca\r\n\r\n lpia architecture &#40;Low Power Intel Architecture&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1_lpia.deb\r\n Size/MD5: 174206 537c0ee33f027fe77b2d988a19addc98\r\n\r\n powerpc architecture &#40;Apple Macintosh G3/G4/G5&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1_powerpc.deb\r\n Size/MD5: 223124 32704bc7de76ad266f152cd26a20799c\r\n\r\n sparc architecture &#40;Sun SPARC/UltraSPARC&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.3+2ubuntu0.1_sparc.deb\r\n Size/MD5: 178220 ef7a7a8d0342e3453b00ee574c7f6f8e\r\n\r\nUpdated packages for Ubuntu 9.10:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1.dsc\r\n Size/MD5: 2098 a8f51b5ddeb65b629fb7d3e37921bdb7\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1.tar.gz\r\n Size/MD5: 2027496 28363c3d291c9f299e40757abbd2ec11\r\n\r\n amd64 architecture &#40;Athlon64, Opteron, EM64T Xeon&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_amd64.deb\r\n Size/MD5: 204686 4c3899eabc2a94b9e3885e61aa8b435d\r\n\r\n i386 architecture &#40;x86 compatible Intel/AMD&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_i386.deb\r\n Size/MD5: 187160 a4493402abed14adba7e186e33117d86\r\n\r\n armel architecture &#40;ARM Architecture&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_armel.deb\r\n Size/MD5: 189234 4d203c561b9c8fe91b50099e8c87cc11\r\n\r\n lpia architecture &#40;Low Power Intel Architecture&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_lpia.deb\r\n Size/MD5: 185760 7acee417b2aee7c54ff7f3eed1301a9e\r\n\r\n powerpc architecture &#40;Apple Macintosh G3/G4/G5&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_powerpc.deb\r\n Size/MD5: 197428 4e7151586bc4139098c820c1d1b812a3\r\n\r\n sparc architecture &#40;Sun SPARC/UltraSPARC&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.4+2ubuntu3.1_sparc.deb\r\n Size/MD5: 196292 29e6bf5806bf8a492dbde60e48281fae\r\n\r\nUpdated packages for Ubuntu 10.04 LTS:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1.dsc\r\n Size/MD5: 2053 af668fc46b52cbbb8fce94579db91662\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1.tar.gz\r\n Size/MD5: 2017972 d68d1519793de89571ed5c78eae9dd1c\r\n\r\n amd64 architecture &#40;Athlon64, Opteron, EM64T Xeon&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1_amd64.deb\r\n Size/MD5: 185406 db3596b0abcd26fe8569687bf790d016\r\n\r\n i386 architecture &#40;x86 compatible Intel/AMD&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1_i386.deb\r\n Size/MD5: 170078 7e6ea917d730b4b54bba69e4e3df533c\r\n\r\n armel architecture &#40;ARM Architecture&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1_armel.deb\r\n Size/MD5: 171114 a3281fd14dea567b7879ebe2c5782087\r\n\r\n powerpc architecture &#40;Apple Macintosh G3/G4/G5&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1_powerpc.deb\r\n Size/MD5: 180332 eb5deb911bd3098f6969e4c758bc5a07\r\n\r\n sparc architecture &#40;Sun SPARC/UltraSPARC&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+1ubuntu2.1_sparc.deb\r\n Size/MD5: 182876 98a7170dd299c3d54b7d1b38f43e1058\r\n\r\nUpdated packages for Ubuntu 10.10:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1.dsc\r\n Size/MD5: 2050 89b42bbb00b6f26578c875da2b0fd26c\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1.tar.gz\r\n Size/MD5: 2114046 fd0986fe6eced94861a5b5d012ee5e0b\r\n\r\n amd64 architecture &#40;Athlon64, Opteron, EM64T Xeon&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1_amd64.deb\r\n Size/MD5: 185918 70308628801d2bca8c67d2941422e4fe\r\n\r\n i386 architecture &#40;x86 compatible Intel/AMD&#41;:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1_i386.deb\r\n Size/MD5: 170444 3da72942a1f2351e1f2d9616402b3f9a\r\n\r\n armel architecture &#40;ARM Architecture&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1_armel.deb\r\n Size/MD5: 180638 dfef48402643a2c0d6d718db0023dcb7\r\n\r\n powerpc architecture &#40;Apple Macintosh G3/G4/G5&#41;:\r\n\r\n http://ports.ubuntu.com/pool/main/x/x11-xserver-utils/x11-xserver-utils_7.5+2ubuntu1.1_powerpc.deb\r\n Size/MD5: 180626 9e15d1f000b142344835c57179307227\r\n\r\n\r\n", "edition": 1, "modified": "2011-04-11T00:00:00", "published": "2011-04-11T00:00:00", "id": "SECURITYVULNS:DOC:26094", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:26094", "title": "[USN-1107-1] x11-xserver-utils vulnerability", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "A collection of utilities used to tweak and query the runtime configuration of the X server. ", "modified": "2011-06-11T04:27:26", "published": "2011-06-11T04:27:26", "id": "FEDORA:182B41111E0", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: xorg-x11-server-utils-7.4-17.fc13", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "A collection of utilities used to tweak and query the runtime configuration of the X server. ", "modified": "2011-04-15T21:10:42", "published": "2011-04-15T21:10:42", "id": "FEDORA:C83B8110DC6", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 15 Update: xorg-x11-server-utils-7.5-5.fc15", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "A collection of utilities used to tweak and query the runtime configuration of the X server. ", "modified": "2011-04-14T20:57:38", "published": "2011-04-14T20:57:38", "id": "FEDORA:31A781111E3", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 14 Update: xorg-x11-server-utils-7.5-5.fc14", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2019-08-13T18:45:44", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "The xorg-x11-server-utils package contains a collection of utilities used\nto modify and query the runtime configuration of the X.Org server. X.Org is\nan open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility, xrdb.\nCertain variables were not properly sanitized during the launch of a user's\ngraphical session, which could possibly allow a remote attacker to execute\narbitrary code with root privileges, if they were able to make the display\nmanager execute xrdb with a specially-crafted X client hostname. For\nexample, by configuring the hostname on the target system via a crafted\nDHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\nconnect to that system from a host that has a special DNS name.\n(CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\noriginal reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running X.Org\nserver instances must be restarted for this update to take effect.\n", "modified": "2018-06-06T20:24:11", "published": "2011-04-11T04:00:00", "id": "RHSA-2011:0433", "href": "https://access.redhat.com/errata/RHSA-2011:0433", "type": "redhat", "title": "(RHSA-2011:0433) Moderate: xorg-x11-server-utils security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:45:48", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "X.Org is an open source implementation of the X Window System. It provides\nthe basic low-level functionality that full-fledged graphical user\ninterfaces are designed upon.\n\nA flaw was found in the X.Org X server resource database utility, xrdb.\nCertain variables were not properly sanitized during the launch of a user's\ngraphical session, which could possibly allow a remote attacker to execute\narbitrary code with root privileges, if they were able to make the display\nmanager execute xrdb with a specially-crafted X client hostname. For\nexample, by configuring the hostname on the target system via a crafted\nDHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\nconnect to that system from a host that has a special DNS name.\n(CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\noriginal reporter.\n\nUsers of xorg-x11 should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for this update to take effect.\n", "modified": "2017-09-08T12:14:07", "published": "2011-04-11T04:00:00", "id": "RHSA-2011:0432", "href": "https://access.redhat.com/errata/RHSA-2011:0432", "type": "redhat", "title": "(RHSA-2011:0432) Moderate: xorg-x11 security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:35:46", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "[7.4-15.el6_0.1]\n- cve-2011-0465: Sanitize cpp macro expansion. (CVE 2011-0465)", "edition": 4, "modified": "2011-04-12T00:00:00", "published": "2011-04-12T00:00:00", "id": "ELSA-2011-0433", "href": "http://linux.oracle.com/errata/ELSA-2011-0433.html", "title": "xorg-x11-server-utils security update", "type": "oraclelinux", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "freebsd": [{"lastseen": "2019-05-29T18:34:00", "bulletinFamily": "unix", "cvelist": ["CVE-2011-0465"], "description": "\nMatthias Hopf reports:\n\nBy crafting hostnames with shell escape characters, arbitrary\n\t commands can be executed in a root environment when a display\n\t manager reads in the resource database via xrdb.\nThese specially crafted hostnames can occur in two environments:\nSystems are affected are: systems set their hostname via DHCP,\n\t and the used DHCP client allows setting of hostnames with illegal\n\t characters. And systems that allow remote logins via xdmcp.\n\n", "edition": 4, "modified": "2011-04-05T00:00:00", "published": "2011-04-05T00:00:00", "id": "2ECCB24F-61C0-11E0-B199-0015F2DB7BDE", "href": "https://vuxml.freebsd.org/freebsd/2eccb24f-61c0-11e0-b199-0015f2db7bde.html", "title": "xrdb -- root hole via rogue hostname", "type": "freebsd", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-17T13:09:05", "description": "An updated xorg-x11-server-utils package that fixes one security issue\nis now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nThe xorg-x11-server-utils package contains a collection of utilities\nused to modify and query the runtime configuration of the X.Org\nserver. X.Org is an open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running\nX.Org server instances must be restarted for this update to take\neffect.", "edition": 33, "published": "2011-04-12T00:00:00", "title": "RHEL 5 / 6 : xorg-x11-server-utils (RHSA-2011:0433)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-12T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:5.6", "p-cpe:/a:redhat:enterprise_linux:xorg-x11-server-utils-debuginfo", "p-cpe:/a:redhat:enterprise_linux:xorg-x11-server-utils", "cpe:/o:redhat:enterprise_linux:6", "cpe:/o:redhat:enterprise_linux:6.0"], "id": "REDHAT-RHSA-2011-0433.NASL", "href": "https://www.tenable.com/plugins/nessus/53371", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2011:0433. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53371);\n script_version(\"1.24\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"RHSA\", value:\"2011:0433\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"RHEL 5 / 6 : xorg-x11-server-utils (RHSA-2011:0433)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated xorg-x11-server-utils package that fixes one security issue\nis now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nThe xorg-x11-server-utils package contains a collection of utilities\nused to modify and query the runtime configuration of the X.Org\nserver. X.Org is an open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running\nX.Org server instances must be restarted for this update to take\neffect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-0465\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2011:0433\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected xorg-x11-server-utils and / or\nxorg-x11-server-utils-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:xorg-x11-server-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:xorg-x11-server-utils-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/04/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 5.x / 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2011:0433\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"xorg-x11-server-utils-7.1-5.el5_6.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"xorg-x11-server-utils-7.1-5.el5_6.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"xorg-x11-server-utils-7.1-5.el5_6.1\")) flag++;\n\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"xorg-x11-server-utils-7.4-15.el6_0.1\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"xorg-x11-server-utils-7.4-15.el6_0.1\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"xorg-x11-server-utils-7.4-15.el6_0.1\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"xorg-x11-server-utils-debuginfo-7.4-15.el6_0.1\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xorg-x11-server-utils / xorg-x11-server-utils-debuginfo\");\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T11:53:12", "description": "A vulnerability has been found and corrected in xrdb :\n\nxrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote\nattackers to execute arbitrary commands via shell metacharacters in a\nhostname obtained from a (1) DHCP or (2) XDMCP message\n(CVE-2011-0465).\n\nPackages for 2009.0 are provided as of the Extended Maintenance\nProgram. Please visit this link to learn more:\nhttp://store.mandriva.com/product_info.php?cPath=149 products_id=490\n\nThe updated packages have been patched to correct this issue.", "edition": 26, "published": "2011-04-22T00:00:00", "title": "Mandriva Linux Security Advisory : xrdb (MDVSA-2011:076)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-22T00:00:00", "cpe": ["cpe:/o:mandriva:linux:2009.0", "cpe:/o:mandriva:linux:2010.1", "cpe:/o:mandriva:linux:2010.0", "p-cpe:/a:mandriva:linux:xrdb"], "id": "MANDRIVA_MDVSA-2011-076.NASL", "href": "https://www.tenable.com/plugins/nessus/53524", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2011:076. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53524);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"MDVSA\", value:\"2011:076\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Mandriva Linux Security Advisory : xrdb (MDVSA-2011:076)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Mandriva Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability has been found and corrected in xrdb :\n\nxrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote\nattackers to execute arbitrary commands via shell metacharacters in a\nhostname obtained from a (1) DHCP or (2) XDMCP message\n(CVE-2011-0465).\n\nPackages for 2009.0 are provided as of the Extended Maintenance\nProgram. Please visit this link to learn more:\nhttp://store.mandriva.com/product_info.php?cPath=149 products_id=490\n\nThe updated packages have been patched to correct this issue.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xrdb package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:xrdb\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/22\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2009.0\", reference:\"xrdb-1.0.5-2.1mdv2009.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2010.0\", reference:\"xrdb-1.0.5-3.1mdv2010.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2010.1\", reference:\"xrdb-1.0.6-1.1mdv2010.2\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:09:31", "description": "Fixes CVE-2011-0465 root hole via rogue hostname (xrdb)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 29, "published": "2011-04-15T00:00:00", "title": "Fedora 14 : xorg-x11-server-utils-7.5-5.fc14 (2011-4871)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-15T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:14", "p-cpe:/a:fedoraproject:fedora:xorg-x11-server-utils"], "id": "FEDORA_2011-4871.NASL", "href": "https://www.tenable.com/plugins/nessus/53438", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-4871.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53438);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"FEDORA\", value:\"2011-4871\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Fedora 14 : xorg-x11-server-utils-7.5-5.fc14 (2011-4871)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fixes CVE-2011-0465 root hole via rogue hostname (xrdb)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-April/057928.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5622e47e\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xorg-x11-server-utils package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xorg-x11-server-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:14\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/15\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^14([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 14.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC14\", reference:\"xorg-x11-server-utils-7.5-5.fc14\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xorg-x11-server-utils\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T12:45:51", "description": "From Red Hat Security Advisory 2011:0433 :\n\nAn updated xorg-x11-server-utils package that fixes one security issue\nis now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nThe xorg-x11-server-utils package contains a collection of utilities\nused to modify and query the runtime configuration of the X.Org\nserver. X.Org is an open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running\nX.Org server instances must be restarted for this update to take\neffect.", "edition": 30, "published": "2013-07-12T00:00:00", "title": "Oracle Linux 5 / 6 : xorg-x11-server-utils (ELSA-2011-0433)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2013-07-12T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "cpe:/o:oracle:linux:5", "p-cpe:/a:oracle:linux:xorg-x11-server-utils"], "id": "ORACLELINUX_ELSA-2011-0433.NASL", "href": "https://www.tenable.com/plugins/nessus/68254", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2011:0433 and \n# Oracle Linux Security Advisory ELSA-2011-0433 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(68254);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"RHSA\", value:\"2011:0433\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Oracle Linux 5 / 6 : xorg-x11-server-utils (ELSA-2011-0433)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2011:0433 :\n\nAn updated xorg-x11-server-utils package that fixes one security issue\nis now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nThe xorg-x11-server-utils package contains a collection of utilities\nused to modify and query the runtime configuration of the X.Org\nserver. X.Org is an open source implementation of the X Window System.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11-server-utils should upgrade to this updated package,\nwhich contains a backported patch to resolve this issue. All running\nX.Org server instances must be restarted for this update to take\neffect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2011-April/002068.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2011-April/002070.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xorg-x11-server-utils package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-server-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/04/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(5|6)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 5 / 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL5\", reference:\"xorg-x11-server-utils-7.1-5.el5_6.1\")) flag++;\n\nif (rpm_check(release:\"EL6\", reference:\"xorg-x11-server-utils-7.4-15.el6_0.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xorg-x11-server-utils\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T14:02:44", "description": "The following bug has been fixed :\n\n - Remote attackers could execute arbitrary commands as\n root by assigning specially crafted hostnames to X11\n clients via XDMCP. (CVE-2011-0465)", "edition": 24, "published": "2011-04-13T00:00:00", "title": "SuSE9 Security Update : XFree86 (YOU Patch Number 12700)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-13T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE9_12700.NASL", "href": "https://www.tenable.com/plugins/nessus/53401", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53401);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"SuSE9 Security Update : XFree86 (YOU Patch Number 12700)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 9 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The following bug has been fixed :\n\n - Remote attackers could execute arbitrary commands as\n root by assigning specially crafted hostnames to X11\n clients via XDMCP. (CVE-2011-0465)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2011-0465.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply YOU patch number 12700.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/13\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 9 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Mesa-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Mesa-devel-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Xnest-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Xprt-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Xvfb-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-Xvnc-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-devel-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-doc-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-driver-options-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-fonts-100dpi-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-fonts-75dpi-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-fonts-cyrillic-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-fonts-scalable-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-fonts-syriac-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-libs-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-man-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-server-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"XFree86-server-glx-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"km_drm-4.3.99.902-43.105\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"XFree86-Mesa-32bit-9-201104080857\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"XFree86-Mesa-devel-32bit-9-201104080857\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"XFree86-devel-32bit-9-201104080857\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"XFree86-libs-32bit-9-201104080857\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:09:31", "description": "fixes CVE-2011-0465 root hole via rogue hostname in xrdb\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 22, "published": "2011-04-18T00:00:00", "title": "Fedora 15 : xorg-x11-server-utils-7.5-5.fc15 (2011-4984)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-18T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:15", "p-cpe:/a:fedoraproject:fedora:xorg-x11-server-utils"], "id": "FEDORA_2011-4984.NASL", "href": "https://www.tenable.com/plugins/nessus/53456", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-4984.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53456);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_bugtraq_id(47189);\n script_xref(name:\"FEDORA\", value:\"2011-4984\");\n\n script_name(english:\"Fedora 15 : xorg-x11-server-utils-7.5-5.fc15 (2011-4984)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fixes CVE-2011-0465 root hole via rogue hostname in xrdb\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-April/057977.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?cacb440b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xorg-x11-server-utils package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xorg-x11-server-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:15\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^15([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 15.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC15\", reference:\"xorg-x11-server-utils-7.5-5.fc15\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xorg-x11-server-utils\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-17T12:45:51", "description": "From Red Hat Security Advisory 2011:0432 :\n\nUpdated xorg-x11 packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nX.Org is an open source implementation of the X Window System. It\nprovides the basic low-level functionality that full-fledged graphical\nuser interfaces are designed upon.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11 should upgrade to these updated packages, which\ncontain a backported patch to resolve this issue. All running X.Org\nserver instances must be restarted for this update to take effect.", "edition": 30, "published": "2013-07-12T00:00:00", "title": "Oracle Linux 4 : xorg-x11 (ELSA-2011-0432)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2013-07-12T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:xorg-x11-sdk", "p-cpe:/a:oracle:linux:xorg-x11-Xnest", "p-cpe:/a:oracle:linux:xorg-x11-Xdmx", "p-cpe:/a:oracle:linux:xorg-x11-tools", "p-cpe:/a:oracle:linux:xorg-x11-Mesa-libGL", "p-cpe:/a:oracle:linux:xorg-x11-xfs", "p-cpe:/a:oracle:linux:xorg-x11-libs", "p-cpe:/a:oracle:linux:xorg-x11-deprecated-libs", "p-cpe:/a:oracle:linux:xorg-x11", "p-cpe:/a:oracle:linux:xorg-x11-doc", "p-cpe:/a:oracle:linux:xorg-x11-Xvfb", "p-cpe:/a:oracle:linux:xorg-x11-devel", "p-cpe:/a:oracle:linux:xorg-x11-xdm", "p-cpe:/a:oracle:linux:xorg-x11-xauth", "cpe:/o:oracle:linux:4", "p-cpe:/a:oracle:linux:xorg-x11-font-utils", "p-cpe:/a:oracle:linux:xorg-x11-deprecated-libs-devel", "p-cpe:/a:oracle:linux:xorg-x11-twm", "p-cpe:/a:oracle:linux:xorg-x11-Mesa-libGLU"], "id": "ORACLELINUX_ELSA-2011-0432.NASL", "href": "https://www.tenable.com/plugins/nessus/68253", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2011:0432 and \n# Oracle Linux Security Advisory ELSA-2011-0432 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(68253);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"RHSA\", value:\"2011:0432\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Oracle Linux 4 : xorg-x11 (ELSA-2011-0432)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2011:0432 :\n\nUpdated xorg-x11 packages that fix one security issue are now\navailable for Red Hat Enterprise Linux 4.\n\nThe Red Hat Security Response Team has rated this update as having\nmoderate security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from\nthe CVE link in the References section.\n\nX.Org is an open source implementation of the X Window System. It\nprovides the basic low-level functionality that full-fledged graphical\nuser interfaces are designed upon.\n\nA flaw was found in the X.Org X server resource database utility,\nxrdb. Certain variables were not properly sanitized during the launch\nof a user's graphical session, which could possibly allow a remote\nattacker to execute arbitrary code with root privileges, if they were\nable to make the display manager execute xrdb with a specially crafted\nX client hostname. For example, by configuring the hostname on the\ntarget system via a crafted DHCP reply, or by using the X Display\nManager Control Protocol (XDMCP) to connect to that system from a host\nthat has a special DNS name. (CVE-2011-0465)\n\nRed Hat would like to thank Matthieu Herrb for reporting this issue.\nUpstream acknowledges Sebastian Krahmer of the SuSE Security Team as\nthe original reporter.\n\nUsers of xorg-x11 should upgrade to these updated packages, which\ncontain a backported patch to resolve this issue. All running X.Org\nserver instances must be restarted for this update to take effect.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2011-April/002067.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xorg-x11 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-Mesa-libGL\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-Mesa-libGLU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-Xdmx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-Xnest\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-Xvfb\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-deprecated-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-deprecated-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-font-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-sdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-twm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-xauth\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-xdm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:xorg-x11-xfs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/04/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 4\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-Mesa-libGL-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-Mesa-libGLU-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-Xdmx-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-Xnest-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-Xvfb-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-deprecated-libs-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-deprecated-libs-devel-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-devel-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-doc-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-font-utils-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-libs-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-sdk-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-tools-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-twm-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-xauth-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-xdm-6.8.2-1.0.1.EL.67\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"xorg-x11-xfs-6.8.2-1.0.1.EL.67\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xorg-x11 / xorg-x11-Mesa-libGL / xorg-x11-Mesa-libGLU / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T09:10:35", "description": "New xrdb packages are available for Slackware 12.0, 12.1, 12.2, 13.0,\n13.1, and -current to fix a security issue.", "edition": 25, "published": "2011-04-12T00:00:00", "title": "Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : xrdb (SSA:2011-096-01)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-12T00:00:00", "cpe": ["cpe:/o:slackware:slackware_linux:12.0", "p-cpe:/a:slackware:slackware_linux:xrdb", "cpe:/o:slackware:slackware_linux:12.2", "cpe:/o:slackware:slackware_linux:13.0", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:12.1", "cpe:/o:slackware:slackware_linux:13.1"], "id": "SLACKWARE_SSA_2011-096-01.NASL", "href": "https://www.tenable.com/plugins/nessus/53361", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2011-096-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53361);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"SSA\", value:\"2011-096-01\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : xrdb (SSA:2011-096-01)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New xrdb packages are available for Slackware 12.0, 12.1, 12.2, 13.0,\n13.1, and -current to fix a security issue.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.465748\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c33b6954\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xrdb package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:xrdb\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:12.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:12.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:12.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/12\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"12.0\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1_slack12.0\")) flag++;\n\nif (slackware_check(osver:\"12.1\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1_slack12.1\")) flag++;\n\nif (slackware_check(osver:\"12.2\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1_slack12.2\")) flag++;\n\nif (slackware_check(osver:\"13.0\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", arch:\"x86_64\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.0\")) flag++;\n\nif (slackware_check(osver:\"13.1\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", arch:\"x86_64\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"x86_64\", pkgnum:\"1_slack13.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"i486\", pkgnum:\"1\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"xrdb\", pkgver:\"1.0.9\", pkgarch:\"x86_64\", pkgnum:\"1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T14:00:47", "description": "X11 6.6.2_x86: xrdb patch.\nDate this patch was last updated by Sun : Jun/14/11", "edition": 21, "published": "2018-03-12T00:00:00", "title": "Solaris 10 (x86) : 147228-01", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2018-03-12T00:00:00", "cpe": ["p-cpe:/a:oracle:solaris:10:147228", "cpe:/o:oracle:solaris:10"], "id": "SOLARIS10_X86_147228-01.NASL", "href": "https://www.tenable.com/plugins/nessus/108097", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text in this plugin was\n# extracted from the Oracle SunOS Patch Updates.\n#\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108097);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Solaris 10 (x86) : 147228-01\");\n script_summary(english:\"Check for patch 147228-01\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote host is missing Sun Security Patch number 147228-01\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"X11 6.6.2_x86: xrdb patch.\nDate this patch was last updated by Sun : Jun/14/11\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://getupdates.oracle.com/readme/147228-01\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Install patch 147228-01\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:solaris:10:147228\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:solaris:10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/06/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/12\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Solaris Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Solaris/showrev\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"solaris.inc\");\n\nshowrev = get_kb_item(\"Host/Solaris/showrev\");\nif (empty_or_null(showrev)) audit(AUDIT_OS_NOT, \"Solaris\");\nos_ver = pregmatch(pattern:\"Release: (\\d+.(\\d+))\", string:showrev);\nif (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Solaris\");\nfull_ver = os_ver[1];\nos_level = os_ver[2];\nif (full_ver != \"5.10\") audit(AUDIT_OS_NOT, \"Solaris 10\", \"Solaris \" + os_level);\npackage_arch = pregmatch(pattern:\"Application architecture: (\\w+)\", string:showrev);\nif (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH);\npackage_arch = package_arch[1];\nif (package_arch != \"i386\") audit(AUDIT_ARCH_NOT, \"i386\", package_arch);\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nif (solaris_check_patch(release:\"5.10_x86\", arch:\"i386\", patch:\"147228-01\", obsoleted_by:\"\", package:\"SUNWxwplt\", version:\"6.6.2.7400,REV=0.2004.12.15\") < 0) flag++;\n\nif (flag) {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : solaris_get_report()\n );\n} else {\n patch_fix = solaris_patch_fix_get();\n if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, \"Solaris 10\");\n tested = solaris_pkg_tests_get();\n if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n audit(AUDIT_PACKAGE_NOT_INSTALLED, \"SUNWxwplt\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-06T09:46:26", "description": "Sebastian Krahmer discovered that the xrdb utility of\nx11-xserver-utils, a X server resource database utility, is not\nproperly filtering crafted hostnames. This allows a remote attacker to\nexecute arbitrary code with root privileges given that either remote\nlogins via xdmcp are allowed or the attacker is able to place a rogue\nDHCP server into the victims network.", "edition": 19, "published": "2011-04-11T00:00:00", "title": "Debian DSA-2213-1 : x11-xserver-utils - missing input sanitization", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "modified": "2011-04-11T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:x11-xserver-utils"], "id": "DEBIAN_DSA-2213.NASL", "href": "https://www.tenable.com/plugins/nessus/53340", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2213. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(53340);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2011-0465\");\n script_bugtraq_id(47189);\n script_xref(name:\"DSA\", value:\"2213\");\n script_xref(name:\"IAVA\", value:\"2017-A-0098\");\n\n script_name(english:\"Debian DSA-2213-1 : x11-xserver-utils - missing input sanitization\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Sebastian Krahmer discovered that the xrdb utility of\nx11-xserver-utils, a X server resource database utility, is not\nproperly filtering crafted hostnames. This allows a remote attacker to\nexecute arbitrary code with root privileges given that either remote\nlogins via xdmcp are allowed or the attacker is able to place a rogue\nDHCP server into the victims network.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/x11-xserver-utils\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2011/dsa-2213\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the x11-xserver-utils packages.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 7.3+6.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 7.5+3.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:x11-xserver-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/04/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/04/11\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"x11-xserver-utils\", reference:\"7.3+6\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"x11-xserver-utils\", reference:\"7.5+3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2017-07-25T10:55:39", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Check for the Version of xorg-x11-server-utils", "modified": "2017-07-10T00:00:00", "published": "2011-08-09T00:00:00", "id": "OPENVAS:880499", "href": "http://plugins.openvas.org/nasl.php?oid=880499", "type": "openvas", "title": "CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 i386", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The xorg-x11-server-utils package contains a collection of utilities used\n to modify and query the runtime configuration of the X.Org server. X.Org is\n an open source implementation of the X Window System.\n\n A flaw was found in the X.Org X server resource database utility, xrdb.\n Certain variables were not properly sanitized during the launch of a user's\n graphical session, which could possibly allow a remote attacker to execute\n arbitrary code with root privileges, if they were able to make the display\n manager execute xrdb with a specially-crafted X client hostname. For\n example, by configuring the hostname on the target system via a crafted\n DHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\n connect to that system from a host that has a special DNS name.\n (CVE-2011-0465)\n \n Red Hat would like to thank Matthieu Herrb for reporting this issue.\n Upstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\n original reporter.\n \n Users of xorg-x11-server-utils should upgrade to this updated package,\n which contains a backported patch to resolve this issue. All running X.Org\n server instances must be restarted for this update to take effect.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"xorg-x11-server-utils on CentOS 5\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2011-April/017321.html\");\n script_id(880499);\n script_version(\"$Revision: 6653 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:46:53 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"CESA\", value: \"2011:0433\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 i386\");\n\n script_summary(\"Check for the Version of xorg-x11-server-utils\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.1~5.el5_6.1\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:35:53", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Oracle Linux Local Security Checks ELSA-2011-0433", "modified": "2018-09-28T00:00:00", "published": "2015-10-06T00:00:00", "id": "OPENVAS:1361412562310122194", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122194", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2011-0433", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2011-0433.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122194\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-06 14:14:36 +0300 (Tue, 06 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2011-0433\");\n script_tag(name:\"insight\", value:\"ELSA-2011-0433 - xorg-x11-server-utils security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2011-0433\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2011-0433.html\");\n script_cve_id(\"CVE-2011-0465\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux(5|6)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.1~5.el5_6.1\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif(release == \"OracleLinux6\")\n{\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.4~15.el6_0.1\", rls:\"OracleLinux6\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:38:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "The remote host is missing an update as announced\nvia advisory SSA:2011-096-01.", "modified": "2019-03-15T00:00:00", "published": "2012-09-11T00:00:00", "id": "OPENVAS:136141256231069580", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231069580", "type": "openvas", "title": "Slackware Advisory SSA:2011-096-01 xrdb", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: esoft_slk_ssa_2011_096_01.nasl 14202 2019-03-15 09:16:15Z cfischer $\n# Description: Auto-generated from the corresponding slackware advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.69580\");\n script_tag(name:\"creation_date\", value:\"2012-09-11 01:34:21 +0200 (Tue, 11 Sep 2012)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 10:16:15 +0100 (Fri, 15 Mar 2019) $\");\n script_cve_id(\"CVE-2011-0465\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_version(\"$Revision: 14202 $\");\n script_name(\"Slackware Advisory SSA:2011-096-01 xrdb\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Slackware Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/slackware_linux\", \"ssh/login/slackpack\", re:\"ssh/login/release=SLK(12\\.0|12\\.1|12\\.2|13\\.0|13\\.1)\");\n\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=SSA:2011-096-01\");\n\n script_tag(name:\"insight\", value:\"New xrdb packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1,\nand -current to fix a security issue.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to the new package(s).\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update as announced\nvia advisory SSA:2011-096-01.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-slack.inc\");\n\nreport = \"\";\nres = \"\";\n\nif((res = isslkpkgvuln(pkg:\"xrdb\", ver:\"1.0.9-i486-1_slack12.0\", rls:\"SLK12.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"xrdb\", ver:\"1.0.9-i486-1_slack12.1\", rls:\"SLK12.1\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"xrdb\", ver:\"1.0.9-i486-1_slack12.2\", rls:\"SLK12.2\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"xrdb\", ver:\"1.0.9-i486-1_slack13.0\", rls:\"SLK13.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"xrdb\", ver:\"1.0.9-i486-1_slack13.1\", rls:\"SLK13.1\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:39:25", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1107-1", "modified": "2019-03-13T00:00:00", "published": "2011-04-11T00:00:00", "id": "OPENVAS:1361412562310840631", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840631", "type": "openvas", "title": "Ubuntu Update for x11-xserver-utils vulnerability USN-1107-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1107_1.nasl 14132 2019-03-13 09:25:59Z cfischer $\n#\n# Ubuntu Update for x11-xserver-utils vulnerability USN-1107-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-1107-1/\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.840631\");\n script_version(\"$Revision: 14132 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 10:25:59 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-04-11 15:05:25 +0200 (Mon, 11 Apr 2011)\");\n script_xref(name:\"USN\", value:\"1107-1\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"Ubuntu Update for x11-xserver-utils vulnerability USN-1107-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(9\\.10|10\\.10|10\\.04 LTS|8\\.04 LTS)\");\n script_tag(name:\"summary\", value:\"Ubuntu Update for Linux kernel vulnerabilities USN-1107-1\");\n script_tag(name:\"affected\", value:\"x11-xserver-utils vulnerability on Ubuntu 8.04 LTS,\n Ubuntu 9.10,\n Ubuntu 10.04 LTS,\n Ubuntu 10.10\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"Sebastian Krahmer discovered that the xrdb utility incorrectly filtered\n crafted hostnames. An attacker could use this flaw with a malicious\n DHCP server or with a remote xdmcp login and execute arbitrary code,\n resulting in root privilege escalation.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU9.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.4+2ubuntu3.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.5+2ubuntu1.1\", rls:\"UBUNTU10.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.5+1ubuntu2.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU8.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.3+2ubuntu0.1\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-25T10:55:22", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Check for the Version of xorg-x11-server-utils", "modified": "2017-07-10T00:00:00", "published": "2011-06-20T00:00:00", "id": "OPENVAS:863274", "href": "http://plugins.openvas.org/nasl.php?oid=863274", "type": "openvas", "title": "Fedora Update for xorg-x11-server-utils FEDORA-2011-4879", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xorg-x11-server-utils FEDORA-2011-4879\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"xorg-x11-server-utils on Fedora 13\";\ntag_insight = \"A collection of utilities used to tweak and query the runtime configuration\n of the X server.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061390.html\");\n script_id(863274);\n script_version(\"$Revision: 6626 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:30:10 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-20 08:37:08 +0200 (Mon, 20 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2011-4879\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"Fedora Update for xorg-x11-server-utils FEDORA-2011-4879\");\n\n script_summary(\"Check for the Version of xorg-x11-server-utils\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.4~17.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "The remote host is missing an update to the system\n as announced in the referenced advisory.", "modified": "2018-10-05T00:00:00", "published": "2011-05-12T00:00:00", "id": "OPENVAS:136141256231069599", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231069599", "type": "openvas", "title": "FreeBSD Ports: xrdb", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: freebsd_xrdb.nasl 11762 2018-10-05 10:54:12Z cfischer $\n#\n# Auto generated from VID 2eccb24f-61c0-11e0-b199-0015f2db7bde\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.69599\");\n script_version(\"$Revision: 11762 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-05 12:54:12 +0200 (Fri, 05 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-05-12 19:21:50 +0200 (Thu, 12 May 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"FreeBSD Ports: xrdb\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsd\", \"ssh/login/freebsdrel\");\n\n script_tag(name:\"insight\", value:\"The following package is affected: xrdb\n\nCVE-2011-0465\nxrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote\nattackers to execute arbitrary commands via shell metacharacters in a\nhostname obtained from a (1) DHCP or (2) XDMCP message.\");\n\n script_tag(name:\"solution\", value:\"Update your system with the appropriate patches or\n software upgrades.\");\n\n script_xref(name:\"URL\", value:\"http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html\");\n script_xref(name:\"URL\", value:\"http://www.vuxml.org/freebsd/2eccb24f-61c0-11e0-b199-0015f2db7bde.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update to the system\n as announced in the referenced advisory.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-bsd.inc\");\n\nvuln = FALSE;\ntxt = \"\";\n\nbver = portver(pkg:\"xrdb\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.0.6_1\")<0) {\n txt += 'Package xrdb version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\n\nif(vuln) {\n security_message(data:txt);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:40:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "The remote host is missing an update to x11-xserver-utils\nannounced via advisory DSA 2213-1.", "modified": "2019-03-18T00:00:00", "published": "2011-05-12T00:00:00", "id": "OPENVAS:136141256231069557", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231069557", "type": "openvas", "title": "Debian Security Advisory DSA 2213-1 (x11-xserver-utils)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2213_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2213-1 (x11-xserver-utils)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.69557\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-05-12 19:21:50 +0200 (Thu, 12 May 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"Debian Security Advisory DSA 2213-1 (x11-xserver-utils)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(5|6)\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202213-1\");\n script_tag(name:\"insight\", value:\"Sebastian Krahmer discovered that the xrdb utility of x11-xserver-utils,\na X server resource database utility, is not properly filtering crafted\nhostnames. This allows a remote attacker to execute arbitrary code with\nroot privileges given that either remote logins via xdmcp are allowed or\nthe attacker is able to place a rogue DHCP server into the victims network.\n\n\nThe oldstable distribution (lenny), this problem has been fixed in\nversion 7.3+6.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 7.5+3.\n\nFor the testing distribution (wheezy), this problem will be fixed soon.\n\nFor the testing distribution (sid), this problem has been fixed in\nversion 7.6+2.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your x11-xserver-utils packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to x11-xserver-utils\nannounced via advisory DSA 2213-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.3+6\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"x11-xserver-utils\", ver:\"7.5+3\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-27T10:55:06", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Check for the Version of xorg-x11", "modified": "2017-07-12T00:00:00", "published": "2011-04-19T00:00:00", "id": "OPENVAS:870420", "href": "http://plugins.openvas.org/nasl.php?oid=870420", "type": "openvas", "title": "RedHat Update for xorg-x11 RHSA-2011:0432-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for xorg-x11 RHSA-2011:0432-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"X.Org is an open source implementation of the X Window System. It provides\n the basic low-level functionality that full-fledged graphical user\n interfaces are designed upon.\n\n A flaw was found in the X.Org X server resource database utility, xrdb.\n Certain variables were not properly sanitized during the launch of a user's\n graphical session, which could possibly allow a remote attacker to execute\n arbitrary code with root privileges, if they were able to make the display\n manager execute xrdb with a specially-crafted X client hostname. For\n example, by configuring the hostname on the target system via a crafted\n DHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\n connect to that system from a host that has a special DNS name.\n (CVE-2011-0465)\n \n Red Hat would like to thank Matthieu Herrb for reporting this issue.\n Upstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\n original reporter.\n \n Users of xorg-x11 should upgrade to these updated packages, which contain a\n backported patch to resolve this issue. All running X.Org server instances\n must be restarted for this update to take effect.\";\n\ntag_affected = \"xorg-x11 on Red Hat Enterprise Linux AS version 4,\n Red Hat Enterprise Linux ES version 4,\n Red Hat Enterprise Linux WS version 4\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/rhsa-announce/2011-April/msg00009.html\");\n script_id(870420);\n script_version(\"$Revision: 6685 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:44:46 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-04-19 07:58:39 +0200 (Tue, 19 Apr 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"RHSA\", value: \"2011:0432-01\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"RedHat Update for xorg-x11 RHSA-2011:0432-01\");\n\n script_summary(\"Check for the Version of xorg-x11\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"RHENT_4\")\n{\n\n if ((res = isrpmvuln(pkg:\"xorg-x11\", rpm:\"xorg-x11~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-Mesa-libGL\", rpm:\"xorg-x11-Mesa-libGL~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-Mesa-libGLU\", rpm:\"xorg-x11-Mesa-libGLU~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-Xdmx\", rpm:\"xorg-x11-Xdmx~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-Xnest\", rpm:\"xorg-x11-Xnest~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-Xvfb\", rpm:\"xorg-x11-Xvfb~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-deprecated-libs\", rpm:\"xorg-x11-deprecated-libs~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-deprecated-libs-devel\", rpm:\"xorg-x11-deprecated-libs-devel~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-devel\", rpm:\"xorg-x11-devel~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-doc\", rpm:\"xorg-x11-doc~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-font-utils\", rpm:\"xorg-x11-font-utils~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-libs\", rpm:\"xorg-x11-libs~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-sdk\", rpm:\"xorg-x11-sdk~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-tools\", rpm:\"xorg-x11-tools~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-twm\", rpm:\"xorg-x11-twm~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-xauth\", rpm:\"xorg-x11-xauth~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-xdm\", rpm:\"xorg-x11-xdm~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-xfs\", rpm:\"xorg-x11-xfs~6.8.2~1.EL.67\", rls:\"RHENT_4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:34", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2011-04-19T00:00:00", "id": "OPENVAS:1361412562310870421", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870421", "type": "openvas", "title": "RedHat Update for xorg-x11-server-utils RHSA-2011:0433-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for xorg-x11-server-utils RHSA-2011:0433-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2011-April/msg00010.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.870421\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-04-19 07:58:39 +0200 (Tue, 19 Apr 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"RHSA\", value:\"2011:0433-01\");\n script_cve_id(\"CVE-2011-0465\");\n script_name(\"RedHat Update for xorg-x11-server-utils RHSA-2011:0433-01\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xorg-x11-server-utils'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_5\");\n script_tag(name:\"affected\", value:\"xorg-x11-server-utils on Red Hat Enterprise Linux (v. 5 server)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"The xorg-x11-server-utils package contains a collection of utilities used\n to modify and query the runtime configuration of the X.Org server. X.Org is\n an open source implementation of the X Window System.\n\n A flaw was found in the X.Org X server resource database utility, xrdb.\n Certain variables were not properly sanitized during the launch of a user's\n graphical session, which could possibly allow a remote attacker to execute\n arbitrary code with root privileges, if they were able to make the display\n manager execute xrdb with a specially-crafted X client hostname. For\n example, by configuring the hostname on the target system via a crafted\n DHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\n connect to that system from a host that has a special DNS name.\n (CVE-2011-0465)\n\n Red Hat would like to thank Matthieu Herrb for reporting this issue.\n Upstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\n original reporter.\n\n Users of xorg-x11-server-utils should upgrade to this updated package,\n which contains a backported patch to resolve this issue. All running X.Org\n server instances must be restarted for this update to take effect.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_5\")\n{\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.1~5.el5_6.1\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils-debuginfo\", rpm:\"xorg-x11-server-utils-debuginfo~7.1~5.el5_6.1\", rls:\"RHENT_5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2018-01-06T13:06:35", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0465"], "description": "Check for the Version of xorg-x11-server-utils", "modified": "2018-01-05T00:00:00", "published": "2012-07-30T00:00:00", "id": "OPENVAS:881377", "href": "http://plugins.openvas.org/nasl.php?oid=881377", "type": "openvas", "title": "CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 x86_64", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 x86_64\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The xorg-x11-server-utils package contains a collection of utilities used\n to modify and query the runtime configuration of the X.Org server. X.Org is\n an open source implementation of the X Window System.\n\n A flaw was found in the X.Org X server resource database utility, xrdb.\n Certain variables were not properly sanitized during the launch of a user's\n graphical session, which could possibly allow a remote attacker to execute\n arbitrary code with root privileges, if they were able to make the display\n manager execute xrdb with a specially-crafted X client hostname. For\n example, by configuring the hostname on the target system via a crafted\n DHCP reply, or by using the X Display Manager Control Protocol (XDMCP) to\n connect to that system from a host that has a special DNS name.\n (CVE-2011-0465)\n \n Red Hat would like to thank Matthieu Herrb for reporting this issue.\n Upstream acknowledges Sebastian Krahmer of the SuSE Security Team as the\n original reporter.\n \n Users of xorg-x11-server-utils should upgrade to this updated package,\n which contains a backported patch to resolve this issue. All running X.Org\n server instances must be restarted for this update to take effect.\";\n\ntag_affected = \"xorg-x11-server-utils on CentOS 5\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2011-April/017322.html\");\n script_id(881377);\n script_version(\"$Revision: 8295 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-05 07:29:18 +0100 (Fri, 05 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-07-30 17:37:38 +0530 (Mon, 30 Jul 2012)\");\n script_cve_id(\"CVE-2011-0465\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"CESA\", value: \"2011:0433\");\n script_name(\"CentOS Update for xorg-x11-server-utils CESA-2011:0433 centos5 x86_64\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of xorg-x11-server-utils\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"xorg-x11-server-utils\", rpm:\"xorg-x11-server-utils~7.1~5.el5_6.1\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:21", "bulletinFamily": "unix", "cvelist": ["CVE-2011-1572", "CVE-2010-4197", "CVE-2011-2472", "CVE-2010-4204", "CVE-2010-3257", "CVE-2011-1097", "CVE-2009-4111", "CVE-2010-1783", "CVE-2011-0465", "CVE-2010-3812", "CVE-2007-4370", "CVE-2010-3389", "CVE-2010-1787", "CVE-2010-1807", "CVE-2011-2473", "CVE-2011-3366", "CVE-2010-1780", "CVE-2009-4023", "CVE-2011-1144", "CVE-2010-4578", "CVE-2011-0904", "CVE-2010-4042", "CVE-2010-2526", "CVE-2010-1786", "CVE-2011-0721", "CVE-2010-1785", "CVE-2011-3365", "CVE-2011-0482", "CVE-2011-2471", "CVE-2010-4493", "CVE-2010-3255", "CVE-2010-1790", "CVE-2010-1788", "CVE-2010-2901", "CVE-2010-3374", "CVE-2011-2524", "CVE-2010-1815", "CVE-2011-0007", "CVE-2011-0905", "CVE-2010-1782", "CVE-2010-1814", "CVE-2010-1792", "CVE-2011-1760", "CVE-2010-3362", "CVE-2010-3259", "CVE-2010-4206", "CVE-2010-1812", "CVE-2010-1791", "CVE-2010-4577", "CVE-2010-4198", "CVE-2010-1784", "CVE-2010-4492", "CVE-2011-1425", "CVE-2011-1072", "CVE-2011-3367", "CVE-2011-0727", "CVE-2011-1951", "CVE-2010-3813", "CVE-2010-3999", "CVE-2010-0778", "CVE-2010-1793"], "edition": 1, "description": "### Background\n\nFor more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild. \n\n### Description\n\nVulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. \n\n * FMOD Studio\n * PEAR Mail\n * LVM2\n * GnuCash\n * xine-lib\n * Last.fm Scrobbler\n * WebKitGTK+\n * shadow tool suite\n * PEAR\n * unixODBC\n * Resource Agents\n * mrouted\n * rsync\n * XML Security Library\n * xrdb\n * Vino\n * OProfile\n * syslog-ng\n * sFlow Toolkit\n * GNOME Display Manager\n * libsoup\n * CA Certificates\n * Gitolite\n * QtCreator\n * Racer\n\n### Impact\n\nA context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, cause Denial of Service, obtain sensitive information, or otherwise bypass security restrictions. \n\n### Workaround\n\nThere are no known workarounds at this time.\n\n### Resolution\n\nAll FMOD Studio users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-libs/fmod-4.38.00\"\n \n\nAll PEAR Mail users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-php/PEAR-Mail-1.2.0\"\n \n\nAll LVM2 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-fs/lvm2-2.02.72\"\n \n\nAll GnuCash users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-office/gnucash-2.4.4\"\n \n\nAll xine-lib users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-libs/xine-lib-1.1.19\"\n \n\nAll Last.fm Scrobbler users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=media-sound/lastfmplayer-1.5.4.26862-r3\"\n \n\nAll WebKitGTK+ users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/webkit-gtk-1.2.7\"\n \n\nAll shadow tool suite users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=sys-apps/shadow-4.1.4.3\"\n \n\nAll PEAR users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-php/PEAR-PEAR-1.9.2-r1\"\n \n\nAll unixODBC users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-db/unixODBC-2.3.0-r1\"\n \n\nAll Resource Agents users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=sys-cluster/resource-agents-1.0.4-r1\"\n \n\nAll mrouted users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/mrouted-3.9.5\"\n \n\nAll rsync users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/rsync-3.0.8\"\n \n\nAll XML Security Library users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-libs/xmlsec-1.2.17\"\n \n\nAll xrdb users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=x11-apps/xrdb-1.0.9\"\n \n\nAll Vino users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/vino-2.32.2\"\n \n\nAll OProfile users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-util/oprofile-0.9.6-r1\"\n \n\nAll syslog-ng users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-admin/syslog-ng-3.2.4\"\n \n\nAll sFlow Toolkit users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-analyzer/sflowtool-3.20\"\n \n\nAll GNOME Display Manager users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=gnome-base/gdm-3.8.4-r3\"\n \n\nAll libsoup users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/libsoup-2.34.3\"\n \n\nAll CA Certificates users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=app-misc/ca-certificates-20110502-r1\"\n \n\nAll Gitolite users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-vcs/gitolite-1.5.9.1\"\n \n\nAll QtCreator users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-util/qt-creator-2.1.0\"\n \n\nGentoo has discontinued support for Racer. We recommend that users unmerge Racer: \n \n \n # emerge --unmerge \"games-sports/racer-bin\"\n \n\nNOTE: This is a legacy GLSA. Updates for all affected architectures have been available since 2012. It is likely that your system is already no longer affected by these issues.", "modified": "2014-12-11T00:00:00", "published": "2014-12-11T00:00:00", "id": "GLSA-201412-09", "href": "https://security.gentoo.org/glsa/201412-09", "type": "gentoo", "title": "Multiple packages, Multiple vulnerabilities fixed in 2011", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}